Skip to main content

Security Telemetry

Security Telemetry provides access to raw security events generated on your endpoints, allowing you to forward endpoint activity to a SIEM solution for monitoring, investigation, and custom correlation.

The security agent collects the selected event types from the endpoints to which the policy applies and sends them directly to the configured SIEM solution as they occur. To ensure optimal performance and data footprint, the agents send only events relevant to the security of your network. Certain events can generate a significant volume of logs and may increase associated SIEM costs.

The Security Telemetry functionality requires the following:

  • A license that provides access to the EDR feature.

  • Managed endpoints that have the BEST agent installed with the EDR Sensor module enabled and a policy applied with the EDR feature.

  • Additional configuration for some event types. For these specific requirements, refer to Security Telemetry events sent to SIEM.

The following events are available:

  • Processes: create, terminate

  • Files: create, read, modify, move, delete

  • Registry: create and delete keys, modify and delete value

  • User access: login

  • Network connection

  • DNS query

Important

  • This feature requires a license that provides access to the EDR feature.

  • DNS query and Network connection events require the Network Attack Defense module to be installed on the target endpoints and enabled in the applied policy. Enabling DNS query events can generate a significant volume of logs and may increase associated SIEM costs.

There are two available solutions:

Splunk

policy_page_agent_security_telemetry_splunk_cop_93559_en.png

The security agent sends this information in a standard industry format (JSON), directly to the SIEM solution (Splunk). 

To send security events from the target endpoints to the SIEM solution, configure the policy as follows:

  1. Click the toggle to enable Security Telemetry.

  2. Select the SIEM solution you are going to connect to.

  3. Provide the URL of the SIEM server.

    Warning

    HTTPS protocol with TLS 1.2 or higher is required, otherwise, event submission will fail.

  4. In case a security certificate validation error occurs, but you still want to use the SIEM server against the error, select Bypass collector CA validation in Control Center. The option is visible only when the certificate cannot be validated.

    Note

    Such error occurs if GravityZone cannot check the SSL certificate of the HTTP collector against a Certificate Authority or the DNS of the server. For example, when your HTTP collector uses a self-signed security certificate.

  5. Enter the authorization token that secures the connection.

  6. Select the types of events you want to send from the endpoint to the SIEM.

  7. Under the Communication between endpoints and SIEM, choose whether to use a proxy server.

    The agent uses for communication with the SIEM the same proxy server as for the communication with GravityZone.

    You can check its settings in the General > Settings section.

    Once the policy is applied on endpoints, the agent starts sending events as they occur to the configured SIEM server.

Syslog (JSON)

policy_page_agent_security_telemetry_syslog_cop_93559_en.png

The security agent sends this information in a standard industry format (JSON), directly to the SIEM solution. 

Note

For messages to be delivered, the target server needs to have Transport Layer Security (TLS) enabled.

Encoding and BOM

Security Telemetry Syslog messages are UTF-8 encoded, and the MSG part begins with the Unicode byte order mark (BOM). The BOM bytes EF BB BF are added at the start of the message. Because the message content (MSG) contains JSON, custom parsers must account for the leading BOM before decoding JSON. Some SIEMs strip this automatically, others require configuration or a pre-processing step.

This follows RFC 5424, which specifies that when the MSG is encoded in UTF-8 it must start with the ABNF %xEF.BB.BF BOM.

To send security events from the target endpoints to the SIEM solution, configure the policy as follows:

  1. Click the toggle to enable Security Telemetry.

  2. Under SIEM solution select Syslog (JSON).

  3. Under Hostname/IP type in the hostname or IP of the syslog server.

    Note

    The IP address or hostname must be reachable by endpoints.

  4. Enter the port used by endpoints to connect to the syslog server under Port.

  5. Optional: Select Ignore SSL errors if you want to ignore security certificate validation errors. These errors can occur whenGravityZone cannot check the SSL certificate of the HTTP collector against a Certificate Authority or the DNS of the server. For example, when your HTTP collector uses a self-signed security certificate. Note that a security certificate is still required for the TLS connection.

  6. Select the types of events you want to send from the endpoint to the SIEM.

Important

If you have the GravityZone EDR Data Retention Add-on and Security Telemetry is enabled in the endpoint policy, you can now view Raw Events in the Historical Search page. This functionality is available even if you are using the MDR service, forwarding telemetry events to a third-party SIEM, or both.

However, for BEST endpoint versions earlier than 7.9.13.423, which do not support sending telemetry to multiple destinations, event forwarding is limited to a single target, based on a predefined priority. In these cases, GravityZone applies a fallback mechanism:

  • If you have the EDR Data Retention Add-on, use MDR and forward events to a third-party SIEM, events will be sent to MDR.

  • If you use MDR and forward events to a third-party SIEM, events will be sent to MDR.

  • If you use MDR and have the EDR Data Retention Add-on, events will also be sent to MDR.

  • If you have the EDR Data Retention Add-on and forward events to a third-party SIEM, events will be sent to EDR Data Retention.

In this section: