Splunk Integration for Crypto Object Discovery

[Priyanka8440]

Hello Team,
I am working on a requirement to discover cryptographic objects using Splunk. I need to collect relevant log data containing information such as TLS versions, ciphers, certificates, IPs, hosts, ports, and protocols.
Could you please suggest how this data can be collected and integrated into Splunk, and which log sources or Splunk are recommended?
Thank you!

[PickleRick]

This "requirement" is very vague. What does that even mean? Are you supposed to find information in logs you are already ingesting? What kind of information? About certs? About encrypted sessions? About something else? That's something you should know from your sources inventory if your data was properly onboarded (yes, I know, it often isn't - it's just "let's index everything in Splunk and we'll worry about that data usability later").

Or is it "what from your environment could we ingest into Splunk"?

Anyway, it all boils down to what sources you have, and what kind of data you're pulling from them. A lot of what you might be thinking about is typically done by other tools - IPS/firewalls, vulnerability scanners and such and Splunk only gets their output.

If your data is already CIM-normalized, you can query the Certificates datamodel.

[_Raj]

Hi,

Install Zeek on a Linux VM and generate HTTPS traffic:

Bash:

curl https://www.google.com
curl https://github.com
curl https://www.microsoft.com

Zeek can generate TLS/SSL logs containing fields such as:

ts
uid
id.orig_h
id.orig_p
id.resp_h
id.resp_p
version
cipher
server_name
subject
issuer
validation_status

A sample event can look conceptually like:

id.orig_h=10.10.1.20
id.orig_p=52144
id.resp_h=142.250.x.x
id.resp_p=443
version=TLSv1.3
cipher=TLS_AES_256_GCM_SHA384
server_name=example.com
subject=CN=example.com
issuer=CN=Example CA

You can then send the Zeek log to Splunk using a Universal Forwarder or Heavy Forwarder.

[_Raj]

Hi,

For cryptographic-object discovery in Splunk, I would prioritize the sources like this

     

Log source / Splunk product	What you can collect
Splunk Stream	TLS version, cipher, source/destination IP, ports, protocol, certificate/TLS metadata
F5 / Palo Alto / Fortinet / proxy / load balancer logs	TLS versions, ciphers, certificates, client/server IPs, ports
Nginx / Apache / HAProxy / API Gateway logs	TLS version, cipher, server name, client IP, certificate-related information
Windows Schannel Event Logs	TLS/SSL and certificate events
Linux/OpenSSL certificate inventory	Certificate subject, issuer, expiry, algorithm, key length, fingerprint
Splunk Enterprise Security	Certificates data model, dashboards, correlation/searching

[Priyanka8440]

How can i get sample data. I want log data to retrive the Crypto Object.