NEW: Microsoft Vulnerabilities Report 2022 - Read the Findings of Our Annual Report Read Now

  • Partners
  • Support
  • Careers
  • English
    • Deutsch
    • français
    • español
    • 한국어
    • português
BeyondTrust
  • Products

    Privileged Password Management

    Discover, manage, audit, and monitor privileged accounts and credentials.

    • Password Safe
    • DevOps Secrets Safe
    • Privileged Access Discovery Application

    Endpoint Privilege Management

    Enforce least privilege across Windows, Mac, Linux, and Unix endpoints.

    • Windows and Mac
    • Unix and Linux
    • Active Directory Bridge

    Secure Remote Access

    Centrally manage remote access for service desks, vendors, and operators.

    • Remote Support
    • Privileged Remote Access
    • Privileged Access Discovery Application

    Cloud Security Management

    Automate the management of identities and assets across your multicloud footprint.

    • Cloud Privilege Broker

    BeyondInsight

    Experience the industry’s most innovative, comprehensive platform for privileged access management.

  • Solutions

    Use Cases

    • Cloud Security
    • Compliance
    • Cyber Insurance
    • Digital Transformation
    • Endpoint Security
    • Operational Technology
    • Ransomware
    • Service Desk Efficiency
    • Zero Trust

    Industry Applications

    • Financial Services
    • Government Agencies
    • Healthcare
    • Law Enforcement
    • Manufacturing
    • Schools & Universities

    Solutions

    The BeyondTrust Privileged Access Management portfolio is an integrated solution that provides visibility and control over all privileged accounts and users.

  • Resources

    Learn

    • Blog
    • Customer Stories
    • Competitor Comparisons
    • Datasheets
    • Videos
    • Glossary
    • Infographics
    • Podcast
    • Whitepapers

    Attend

    • Events
    • Go Beyond
    • Training
    • Webinars

    Support

    • Changelog
    • Professional Services
    • Technical Documentation

    Universal Privilege Management

    Our innovative Universal Privilege Management approach secures every user, asset, and session across your entire enterprise.

  • Company
    • About
    • Leadership
    • Core Values
    • Partners
    • Careers
  • Watch Demo
  • Contact Sales

Getting Retina Data into Splunk

March 21, 2014

  • Blog
  • Archive
  1. Home
  2. Blog
  3. Getting Retina Data into Splunk
SIEM products do a great job correlating information from a laundry list of security and operational solutions in order to gain visibility and context within an IT environment. Today we are going to show how to forward Retina Network security data into Splunk to help improve visibility and decision making. This integration can be completed in two simple steps. Step 1 The first step you need to configure is on the Retina Network Security Scanner itself (RNSS). Once you have logged onto RNSS, go to the top menu -> Tools -> Alerting. See the screenshot below:

Img1

Once you click on the ‘Alerting’ option, you will see the following ‘Events’ list:

Img2

The ‘events’ list is where you define what information you want Retina Network Scanner to send over to Splunk. In my case here, I am sending over “Medium Risk Audit” as well as “High Risk Audit” alerts. With these options selected, anytime Retina Network Scanner performs a vulnerability scan, anytime it discovers a High or Medium Risk audit, it will send that information over to my Splunk server. Once you have selected the events you want RNS to send over, click on the ‘Actions’ tab as seen in this screenshot:

Img3

In this section of the ‘alerting’ process, we are going to focus on the ‘SYSLOG’ section. The syslog section is where we are going to configure RNS to send our data over to our Splunk box via SYSLOG. Make sure you define the following sections in the SYSLOG section: Enabled: True (This enables RNS to send data over via syslog) Host: <IP address or hostname of splunkbox> --- This is where RNSS is going to send the data to Priority: By default, you can keep this as “LOG_INFO”. This should be sufficient to get our data into Splunk. Facility: This can also be kept as “LOG_LOCAL0”. Once you have completed these steps on RNS, we have completed all we need to do on the Retina side. The next step is to configure Splunk to accept data from our RNSS. Step 2 Once you have the data in Splunk, you can use Splunk’s searching capabilities to sort through the data forwarded from that Retina Network Scanner. Setting up Splunk is pretty straightforward. We are going to setup Splunk to accept SYSLOG activity via UDP on port 514 (standard syslog port). There are several ways to set this up in Splunk. Here is a one way to setup the connection in Splunk:

Img4

Once you have Splunk accepting SYSLOG logs over UDP port 514, you can now start sending Retina Scan information to Splunk. Once you have ran your vulnerability scans, that data will now be consumed by Splunk, allowing you to view, sort and filter on the Vulnerability data. Here is a screenshot of all the data that has been sent over to Splunk from RNSS.

Img5

Here is another screenshot where we are focusing specifically on the host, 192.168.47.110:

Img6

Here is one more example of sorting on a vulnerability and finding it on multiple hosts. In the below example, I am focusing on “Mozilla” vulnerabilities and as we can see from the results returned back, I have two machines that have this known vulnerability: 192.168.47.141 192.168.47.110

Img7

Now that you have successfully configured RNSS (Retina Network Security Scanner) to send vulnerability scan information to Splunk, it is very easy and flexible to search through the data and find information very quickly.
Photograph of Scott Lang

Scott Lang, Sr. Director, Product Marketing at BeyondTrust

Scott Lang has nearly 20 years of experience in technology product marketing, currently guiding the product marketing strategy for BeyondTrust’s privileged account management solutions and vulnerability management solutions. Prior to joining BeyondTrust, Scott was director of security solution marketing at Dell, formerly Quest Software, where he was responsible for global security campaigns, product marketing for identity and access management and Windows server management.

Stay Up To Date

Get the latest news, ideas, and tactics from BeyondTrust. You may unsubscribe at any time.

I agree to receive product related communications from BeyondTrust as detailed in the Privacy Policy, and I may manage my preferences or withdraw my consent at any time.

You May Also Be Interested In:

Whitepapers

IDSA Report: 2022 Trends in Securing Digital Identities

Whitepapers

Microsoft Vulnerabilities Report 2022

Whitepapers

Mapping BeyondTrust Capabilities to NIST Zero Trust (SP 800-207)

Keep up with BeyondTrust

I agree to receive product related communications from BeyondTrust as detailed in the Privacy Policy, and I may manage my preferences or withdraw my consent at any time.

Customer Support
Contact Sales

Products

  • Endpoint Privilege Management
  • Password Management
  • Privileged Remote Access
  • DevOps Secrets Safe
  • Remote Support
  • Cloud Privilege Broker

Resources

  • Blog
  • Case Studies
  • Competitor Comparisons
  • Datasheets
  • Glossary
  • Infographics
  • Podcast
  • Videos
  • Webinars
  • Whitepapers

About

  • Company
  • Careers
  • Contact
  • Events
  • Leadership Team
  • Partner Program
  • Press
BeyondTrust Logo
  • Facebook
  • Twitter
  • LinkedIn
  • Privacy
  • Security
  • Manage Cookies
  • WEEE Compliance

Copyright © 1999 — 2022 BeyondTrust Corporation. All rights reserved. Other trademarks identified on this page are owned by their respective owners. BeyondTrust Corporation is not a chartered bank or trust company, or depository institution. It is not authorized to accept deposits or trust accounts and is not licensed or regulated by any state or federal banking authority.