Netwrix Auditor

Add-on for Splunk

Quick-Start Guide
Version: 9.7
10/22/2018
Legal Notice

The information in this publication is furnished for information use only, and does not constitute a
commitment from Netwrix Corporation of any features or functions, as this publication may describe
features or functionality not applicable to the product release or version you are using. Netwrix makes no
representations or warranties about the Software beyond what is provided in the License Agreement.
Netwrix Corporation assumes no responsibility or liability for the accuracy of the information presented,
which is subject to change without notice. If you believe there is an error in this publication, please report
it to us in writing.

Netwrix is a registered trademark of Netwrix Corporation. The Netwrix logo and all other Netwrix product
or service names and slogans are registered trademarks or trademarks of Netwrix Corporation. Microsoft,
Active Directory, Exchange, Exchange Online, Office 365, SharePoint, SQL Server, Windows, and Windows
Server are either registered trademarks or trademarks of Microsoft Corporation in the United States
and/or other countries. All other trademarks and registered trademarks are property of their respective
owners.

Disclaimers

This document may contain information regarding the use and installation of non-Netwrix products.
Please note that this information is provided as a courtesy to assist you. While Netwrix tries to ensure
that this information accurately reflects the information provided by the supplier, please refer to the
materials provided with any non-Netwrix product and contact the supplier for confirmation. Netwrix
Corporation assumes no responsibility or liability for incorrect or incomplete information provided about
non-Netwrix products.

© 2018 Netwrix Corporation.

All rights reserved.

2/12
Table of Contents
1. Introduction 4

1.1. Netwrix Auditor Overview 4

2. Netwrix Auditor Add-on for Splunk Overview 5

2.1. Compatibility Notice 5

3. Use the Add-On 6

3.1. Prerequisites 6

3.2. Define Parameters for Add-On 6

3.3. Choose Appropriate Execution Scenario 7

3.4. Run the Add-On with PowerShell 8

3.5. Automate Add-On Execution 9

3.6. See Results 9

4. Netwrix Auditor Integration API Overview 11

3/12
 Netwrix Auditor Add-on for Splunk Quick-Start Guide

1. Introduction

1. Introduction
This guide is intended for the first-time users of Netwrix Auditor Integration API add-ons. It can be used for
evaluation purposes, therefore, it is recommended to read it sequentially, and follow the instructions in the
order they are provided. After reading this guide you will be able to:

l Define add-on parameters

l Execute the add-on

l Review results

NOTE: The add-on works only in combination with Netwrix Auditor so this guide covers a basic procedure
for running the add-on and assumes that you have Netwrix Auditor installed and configured in
your environment. For installation scenarios, data collection options, as well as detailed information
on Integration API, refer to:

l Netwrix Auditor Installation and Configuration Guide

l Netwrix Auditor Administration Guide

l Netwrix Auditor Integration API Overview

1.1. Netwrix Auditor Overview

Netwrix Auditor is a visibility platform for user behavior analysis and risk mitigation that enables control
over changes, configurations and access in hybrid IT environments to protect data regardless of its
location. The platform provides security analytics to detect anomalies in user behavior and investigate
threat patterns before a data breach occurs.

Netwrix Auditor includes applications for Active Directory, Azure AD, Exchange, Office 365, Windows file
servers, EMC storage devices, NetApp filer appliances, SharePoint, Oracle Database, SQL Server, VMware,
and Windows Server. Empowered with a RESTful API and user activity video recording, the platform delivers
visibility and control across all of your on-premises or cloud-based IT systems in a unified way.

Major benefits:

l Detect insider threats—on premises and in the cloud

l Pass compliance audits with less effort and expense

l Increase productivity of IT security and operations teams

To learn how Netwrix Auditor can help your achieve your specific business objectives, refer to Netwrix
Auditor Best Practices Guide.

4/12
 Netwrix Auditor Add-on for Splunk Quick-Start Guide

2. Netwrix Auditor Add-on for Splunk Overview

2. Netwrix Auditor Add-on for

Splunk Overview
Netwrix Auditor helps you protect and get most from your Splunk investment. The Netwrix Auditor Add-on
for Splunk works in collaboration with Netwrix Auditor, supplying additional data that augments the data
collected by Splunk.

The add-on enriches your SIEM data with actionable context in human-readable format, including the
before and after values for every change and data access attempt, both failed and successful. Aggregating
data into a single audit trail simplifies analysis, makes your SIEM more cost effective, and helps you keep
tabs on your IT infrastructure.

Implemented as a PowerShell script, this add-on facilitates the audit data transition from Netwrix Auditor
to Splunk. All you have to do is provide connection details and schedule the script for execution.

On a high level, the add-on works as follows:

1. The add-on connects to the Netwrix Auditor server and retrieves audit data using the Netwrix Auditor
Integration API.

2. The add-on processes Netwrix Auditor-compatible data (Activity Records) into log events that work as
input for Splunk. Each event contains the user account, action, time, and other details.

3. The add-on creates a special Windows event log (Netwrix_ Auditor_ Integration) and stores events
there. These events are structured and ready for integration with Splunk.

For more information on the structure of the Activity Record and the capabilities of the Netwrix Auditor
Integration API, refer to Netwrix Auditor Integration API Overview.

2.1. Compatibility Notice

In Netwrix Auditor 9.0, Netwrix has updated API schemas. The scripts and add-ons designed for Netwrix
Auditor 8.0 – 8.5 might become inoperable in Netwrix Auditor 9.7, while new add-ons designed for 9.0 and
9.7 cannot run at Netwrix Auditor 8.0 – 8.5.

Make sure to check your product version, and then review and update your add-ons and scripts leveraging
Netwrix Auditor Integration API. Download the latest add- on version in the Add- on Store. For more
information about schema updates, refer to Netwrix Auditor Integration API.

5/12
 Netwrix Auditor Add-on for Splunk Quick-Start Guide

3. Use the Add-On

3. Use the Add-On

3.1. Prerequisites
Before running Netwrix Auditor Add-on for Splunk, ensure that all the necessary components and policies
are configured as follows:

On... Ensure that...

The Netwrix Auditor Server l The Audit Database settings are configured in Netwrix Auditor
side Server.

l The TCP 9699 port (default Netwrix Auditor Integration API port) is
open for inbound connections.

l The user retrieving data from the Audit Database is granted the
Global reviewer role in Netwrix Auditor or is a member of the
Netwrix Auditor Client Users group.

Alternatively, you can grant the Global administrator role or add

the user to the Netwrix Auditor Administrators group. In this
case, this user will have the most extended permissions in the
product.

The computer where the l Execution policy for powershell scripts is set to "Unrestricted". Run
script will be executed Windows PowerShell as administrator and execute the following
command:
Set-ExecutionPolicy Unrestricted

l The user running the script is granted the write permission on the
script folder—the add-on creates a special .bin file with the last
exported event.

l The user running the script must be a member of the Domain

Users group.

3.2. Define Parameters for Add-On

Before running or scheduling the add-on, you must define connection details: Netwrix Auditor Server host,
user credentials, etc. Most parameters are optional, the script uses the default values unless parameters
are explicitly defined. You can skip or define parameters depending on your execution scenario and
security policies. See Choose Appropriate Execution Scenario for more information.

6/12
 Netwrix Auditor Add-on for Splunk Quick-Start Guide

3. Use the Add-On

First provide a path to your add-on followed by script parameters with their values. Each parameter is
preceded with a dash; a space separates a parameter name from its value. You can skip some parameters—
the script uses a default value unless a parameter is explicitly defined.

Parameter Default value Description

NetwrixAuditorHost localhost:9699 Assumes that the add-on runs on the computer

hosting Netwrix Auditor Server and uses default
port 9699.

If you want to run the add- on on another

machine, provide a name of the computer where
Netwrix Auditor Server resides (e.g., 172.28.6.15,
EnterpriseNAServer, WKS.enterprise.local).

To specify a non-default port, provide a server

name followed by the port number (e.g.,
WKS.enterprise.local:9999).

NetwrixAuditorUserName Current user Unless specified, the add-on runs with the current
credentials user credentials.

If you want the add-on to use another account to

connect to Netwrix Auditor Server, specify the
account name in the DOMAIN\username format.

NOTE: The account must be assigned the Global

reviewer role in Netwrix Auditor or be a
member of the Netwrix Auditor Client
Users group on the computer hosting
Netwrix Auditor Server.

NetwrixAuditorPassword Current user Unless specified, the script runs with the current
credentials user credentials. Provide a different password if
necessary.

3.3. Choose Appropriate Execution Scenario

Netwrix Auditor Add-on for Splunk runs on any computer in your environment. For example, you can run
the add-on on the computer where Netwrix Auditor is installed or on a remote server. Depending on the
execution scenario you choose, you have to define a different set of parameters. See Define Parameters for
Add-On for more information.

Netwrix suggests the following execution scenarios:

7/12
 Netwrix Auditor Add-on for Splunk Quick-Start Guide

3. Use the Add-On

Scenario Example

The add-on runs on the Netwrix Auditor Server C:\Add-ons\Netwrix_Auditor_Add-on_for_

Splunk.ps1
with the current user credentials. Activity Records
are exported to a local event log.

The add-on runs on the Netwrix Auditor Server C:\Add-ons\Netwrix_Auditor_Add-on_for_

Splunk.ps1 -NetwrixAuditorUserName
with explicitly defined credentials. Activity Records
enterprise\NAuser -NetwrixAuditorPassword
are exported to a local event log. NetwrixIsCool

The add- on exports Activity Records from a C:\Add-ons\Netwrix_Auditor_Add-on_for_

Splunk.ps1 -NetwrixAuditorHost 172.28.6.15
remote Netwrix Auditor Server using current user
credentials and writes data to a local event log.

The add- on exports Activity Records from a C:\Add-ons\Netwrix_Auditor_Add-on_for_

Splunk.ps1 -NetwrixAuditorHost 172.28.6.15
remote Netwrix Auditor Server using explicitly
-NetwrixAuditorUserName enterprise\NAuser -
defined credentials and writes data to a local event NetwrixAuditorPassword NetwrixIsCool
log.

For security reasons, Netwrix recommends running the script with current user credentials (skipping user
credentials). Create a special user account with permissions to both Netwrix Auditor data and event log
and use it for running the script.

3.4. Run the Add-On with PowerShell

To run the script with PowerShell

1. On computer where you want to execute the add-on, start Windows PowerShell.

2. Type a path to the add-on. Or simply drag and drop the add-on file in the console window.

3. Add script parameters. The console will look similar to the following:
Windows PowerShell
Copyright (C) 2014 Microsoft Corporation. All rights reserved.
PS C:\Users\AddOnUser> C:\Add-ons\Netwrix_Auditor_Add-on_for_Splunk.ps1 -
NetwrixAuditorHost 172.28.6.15

NOTE: If the script path contains spaces (e.g., C:\Netwrix Add-ons\ ), embrace it in double quotes
and insert the ampersand (&) symbol in front (e.g., & "C:\Netwrix Add-ons\").

4. Hit Enter.

Depending on the number of Activity Records stored in Netwrix Auditor Audit Database execution may
take a while. Ensure the script execution completed successfully. The Netwrix_Auditor_Integration event
log will be created and filled with events.

8/12
 Netwrix Auditor Add-on for Splunk Quick-Start Guide

3. Use the Add-On

NOTE: By default, the Netwrix_ Auditor_ Integration event log is set to 1GB and "Overwrite events as
needed". Also, all records exceeding 30,000 symbols are trimmed.

Every time you run the script, Netwrix Auditor makes a timestamp. The next time you run the script, it will
start retrieving new Activity Records.

3.5. Automate Add-On Execution

To ensure you feed the most recent data to your SIEM solution, Netwrix recommends scheduling a daily
task for running the add-on.

To create a scheduled task

1. On the computer where you want to execute the add-on, navigate to Task Scheduler.

2. Select Create Task.

3. On the General tab, specify a task name, e.g., Netwrix Auditor Add-on for Splunk. Make sure the
account that runs the task has all necessary rights and permissions.

4. On the Triggers tab, click New and define the schedule. This option controls how often audit data is
exported from Netwrix Auditor and saved to event log. Netwrix recommends scheduling a daily task.

5. On the Actions tab, click New and specify action details. Review the following for additional
information:

Option Value

Action Set to "Start a program".

Program/script Input "Powershell.exe".

Add arguments (optional) Add a path to the add-on in double quotes and specify add-on
parameters. For example:
-file "C:\Add-ons\Netwrix_Auditor_Add-on_for_Splunk.ps1"
-NetwrixAuditorHost 172.28.6.15

6. Save the task.

After creating a task, wait for the next scheduled run or navigate to Task Scheduler and run the task
manually. To do this, right-click a task and click Run.

3.6. See Results

1. On the computer where you executed the add-on, navigate to Start → All Programs → Event
Viewer.

9/12
 Netwrix Auditor Add-on for Splunk Quick-Start Guide

3. Use the Add-On

2. In the Event Viewer dialog, navigate to Event Viewer (local) → Applications and Services Logs →
Netwrix_Auditor_Integration log.

3. Review events.

Now you can augment Splunk with data collected by Netwrix Auditor.

10/12
 Netwrix Auditor Add-on for Splunk Quick-Start Guide

4. Netwrix Auditor Integration API Overview

4. Netwrix Auditor Integration API

Overview
Netwrix Auditor Add-on for Splunk leverages Netwrix Auditor Integration API. Although you can always use
the add-on as is, but Netwrix encourages customers to create their own integration add-ons. The add-ons
created based on Netwrix Auditor Integration API capabilities are easily tailored to your specific
environment and business requirements.

Netwrix Auditor Integration API—endless integration, auditing and reporting capabilities.

The Netwrix Auditor Integration API provides access to audit data collected by Netwrix Auditor through
REST API endpoints. According to the RESTful model, each operation is associated with a URL. Integration
API provides the following capabilities:

l Data in: Solidify security and meet regulatory compliance standards by enabling visibility into what is
going on in any third-party application.

l Data out : Further automate your business processes, IT security and operations workflows by
enriching third-party solutions with actionable audit data.

Netwrix Auditor Integration API operates with XML- and JSON-formatted Activity Records—minimal chunks
of audit data containing information on who changed what, when and where this change was made. XML
format is set as default.

11/12
 Netwrix Auditor Add-on for Splunk Quick-Start Guide

4. Netwrix Auditor Integration API Overview

With Integration API you can write Activity Records to the SQL Server-based Audit Database and access
audit data from remote computers. Also, Netwrix prepares add-ons—sample scripts—to help you integrate
your SIEM solutions with Netwrix Auditor.

Netwrix Auditor Integration API Service is responsible for processing API requests. This component is
installed along with Netwrix Auditor Server and is enabled automatically. By default, Netwrix Auditor
Integration API works over HTTPS protocol using an automatically generated certificate. Default
communication port is 9699 .

Netwrix does not limit you with applications that can be used with Integration API. You can write RESTful
requests using any tool or application you prefer—cURL, Telerik Fiddler, various Google Chrome or Mozilla
FireFox plug-ins, etc.

See Netwrix Auditor Integration API Guide for more information.

12/12