Technical Tip: Integration of AlienVault USM Anywhere for SIEM

Reveal’s Event Streaming functionality can be integrated with AlienVault’s USM Anywhere to receive SIEM events.

1. Generate an access Token for the stream to integrate directly from the Event Streaming page:

2. Ensure the access token that is generated is copied; it will be necessary soon.
3. Login to USM Anywhere and navigate to Data Sources -> Custom Apps -> Add Custom App.
4. Enter App Information, such as a name and category:

5. For API Credentials, enter the following:

Type: API Key Auth

Event URL: <URL from event stream on Reveal>

Header Name: Authorization

Header Value: Bearer <API token from Reveal>

Request Method: GET

Where <API token from Reveal> is replaced with the Token copied in step 2, and <URL from event stream on Reveal> is the URL from the event stream to integrate.

Add a request parameter by selecting Params -> Add Request Param and inputting:

Key: format

Value: json

6. For API Config, enter the following:

Pagination Type: Next Cursor

Next Cursor Response Path: x_ignore

Next Cursor Param Name: x_ignore

Events Response Path: events

Data Filter Condition: Next Cursor

Response Events Sort Order: Asc

Timestamp Filter Param Name: x_ignore

Timestamp Filter Param Value: 2024-06-03T14:04:45.799Z

Timestamp Filter Param Format: Date ISO8601 (YYYY-MM-DDTHH:mm:ss.SSSZ)

Is Timestamp Param Mandatory: No

Latest Event Timestamp Response Path: sensor.timestamp

Latest Event Timestamp Response Format: Date ISO8601 (YYYY-MM-DDTHH:mm:ss.SSSZ)

Ensure to select Params -> Add From Credentials to pass the format:json request parameter.

Ensure that the event stream is actively receiving events, or a No events found error in AlienVault will be received.

Note:

The value sensor.timestamp here is importTant as it points to the correct part of the JSON message that contains the timestamp. This example works for detections; to use the streaming service for any other kind of event (such as audit logs), it will be necessary to use a separate stream/custom app and adjust this path accordingly. See

7. For the Mapping and Summary Fields stages, configure this in whichever format best integrates with the current AlienVault setup.