Technical Tip: Integration of AlienVault USM Anywhere for SIEM

[Anthony_E]

Description	This article describes how to integrate AlienVault USM Anywhere for SIEM.
Scope	FortiDLP.
Solution	Reveal’s Event Streaming functionality can be integrated with AlienVault’s USM Anywhere to receive SIEM events. Generate an access Token for the stream to integrate directly from the Event Streaming page: Ensure the access token that is generated is copied; it will be necessary soon. Login to USM Anywhere and navigate to Data Sources -> Custom Apps -> Add Custom App. Enter App Information, such as a name and category: For API Credentials, enter the following: Type: API Key Auth Event URL: <URL from event stream on Reveal> Header Name: Authorization Header Value: Bearer <API token from Reveal> Request Method: GET Where <API token from Reveal> is replaced with the Token copied in step 2, and <URL from event stream on Reveal> is the URL from the event stream to integrate. Add a request parameter by selecting Params -> Add Request Param and inputting: Key: format Value: json For API Config, enter the following: Pagination Type: Next Cursor Next Cursor Response Path: x_ignore Next Cursor Param Name: x_ignore Events Response Path: events Data Filter Condition: Next Cursor Response Events Sort Order: Asc Timestamp Filter Param Name: x_ignore Timestamp Filter Param Value: 2024-06-03T14:04:45.799Z Timestamp Filter Param Format: Date ISO8601 (YYYY-MM-DDTHH:mm:ss.SSSZ) Is Timestamp Param Mandatory: No Latest Event Timestamp Response Path: sensor.timestamp Latest Event Timestamp Response Format: Date ISO8601 (YYYY-MM-DDTHH:mm:ss.SSSZ) Ensure to select Params -> Add From Credentials to pass the format:json request parameter. Ensure that the event stream is actively receiving events, or a No events found error in AlienVault will be received. Note: The value sensor.timestamp here is importTant as it points to the correct part of the JSON message that contains the timestamp. This example works for detections; to use the streaming service for any other kind of event (such as audit logs), it will be necessary to use a separate stream/custom app and adjust this path accordingly. See For the Mapping and Summary Fields stages, configure this in whichever format best integrates with the current AlienVault setup.