Enable sending CADF events to external SIEM systems¶

You can configure Fluentd running on the RabbitMQ nodes to forward the Cloud Auditing Data Federation (CADF) events to specific external security information and event management (SIEM) systems, such as Splunk, ArcSight, or QRadar. The procedure below provides a configuration example for Splunk.

To enable sending CADF events to Splunk:

1. Open your project Git repository with Reclass model on the cluster level.

2. In classes/cluster/cluster_name/stacklight, create a custom notification channel, for example, fluentd_splunk.yml with the following pillar specifying the hosts and ports in the splunk_output and syslog_output parameters:

   parameters:
     fluentd:
       agent:
         config:
           label:
             audit_messages:
               filter:
                 get_payload_values:
                   tag: audit
                   type: record_transformer
                   enable_ruby: true
                   record:
                     - name: Logger
                       value: ${fluentd:dollar}{ record.dig("publisher_id") }
                     - name: Severity
                       value: ${fluentd:dollar}{ {'TRACE'=>7,'DEBUG'=>7,'INFO'=>6,\
                       'AUDIT'=>6,'WARNING'=>4,'ERROR'=>3,'CRITICAL'=>2}\
                       [record['priority']].to_i }
                     - name: Timestamp
                       value: ${fluentd:dollar}{ DateTime.strptime(record.dig\
                       ("payload", "eventTime"), "%Y-%m-%dT%H:%M:%S.%N%z").strftime\
                       ("%Y-%m-%dT%H:%M:%S.%3NZ") }
                     - name: notification_type
                      value: ${fluentd:dollar}{ record.dig("event_type") }
                     - name: severity_label
                       value: ${fluentd:dollar}{ record.dig("priority") }
                     - name: environment_label
                       value: ${_param:cluster_domain}
                     - name: action
                       value: ${fluentd:dollar}{ record.dig("payload", "action") }
                     - name: event_type
                       value: ${fluentd:dollar}{ record.dig("payload", "eventType") }
                     - name: outcome
                       value: ${fluentd:dollar}{ record.dig("payload", "outcome") }
                 pack_payload_to_json:
                   tag: audit
                   require:
                     - get_payload_values
                   type: record_transformer
                   enable_ruby: true
                   remove_keys: '["payload", "timestamp", "publisher_id", "priority"]'
                   record:
                     - name: Payload
                       value: ${fluentd:dollar}{ record["payload"].to_json }
               match:
                 send_to_default:
                   tag: "**"
                   type: copy
                   store:
                     - type: relabel
                       label: splunk_output
                     - type: relabel
                       label: syslog_output
             splunk_output:
               match:
                 splunk_output:
                   tag: "**"
                   type: splunk_hec
                   host: <splunk_host>
                   port: <splunk_port>
                   token: <splunk_token>
             syslog_output:
               match:
                 syslog_output:
                   tag: "**"
                   type: syslog
                   host: <syslog_host>
                   port: <syslog_port>
   

3. In openstack/message_queue.yml:

   1. Replace the system.fluentd.notifications class with the following ones:

      classes:
      - system.fluentd.label.notifications.input_rabbitmq
      - system.fluentd.label.notifications.notifications
      

   2. Add the custom Fluentd channel as required. For example:

      cluster.<cluster_name>.stacklight.fluentd_splunk
      

4. Log in to the Salt Master node.

5. Apply the fluentd state on the msg nodes:

   salt -C 'I@rabbitmq:server' state.sls fluentd