topic Re: PKI and Splunk in Alerting

PKI and Splunk

itsmevic — Wed, 08 Jan 2020 15:18:41 GMT

Hey there fellow Splunkers, can Splunk be used to help manage PKI? If so, in what ways?

Re: PKI and Splunk

adonio — Wed, 08 Jan 2020 19:07:56 GMT

bring the PKI software data to splunk
alert on expiring keys
automate keys replacement if you wish ...
seen it done many times

Re: PKI and Splunk

itsmevic — Wed, 08 Jan 2020 20:05:58 GMT

Is there a way to pull this data without PKI software implemented? For example, through a log source which might indicate when a certificate is about to expire?

Re: PKI and Splunk

efavreau — Sat, 29 Feb 2020 00:00:24 GMT

Yes. All certs can be interpreted as a series of properties (expiration is one cert property). Common command line tools can query the certs store/wallet/etc. on a daily schedule, and then send that output to a log source (syslog, windows event log, etc.), where Splunk is already picking up the logs.

1) query for gaps between number of certs expected in a day and number received. If the number is off, either a system isn't reporting in, or it's decommissioned, etc.. Splunk alert on it will help you before it's too late. This will make sure your process doesn't accidentally miss a host that was offline for a while.

2) create Splunk reports/dashboards on cert properties for what you need

Lost still? Here's a couple additional pointers for querying certs. This and a few minutes in a search engine should get you going:
https://stackoverflow.com/questions/21297853/how-to-determine-ssl-cert-expiration-date-from-a-pem-encoded-certificate
https://devblogs.microsoft.com/scripting/use-powershell-to-find-certificates-that-are-about-to-expire/