SIEM Integration

It is possible to integrate your dope.swg with whichever SIEM tool your organization is using. We provide two methods for integration using an AWS S3 bucket or HTTP Integration.

Method 1. AWS S3 Integration

Simply provide dope.security with the location of your organization's AWS S3 Bucket where we can send all web transactions from each dope. endpoint.

Each dope.endpoint sends all web transactions for that endpoint to the dope.cloud every 15 mins. Once SIEM Integration is enabled the dope.cloud will ensure all of this log data is sent to your organization's AWS S3 bucket as it is received from the dope.endpoint.

The data is sent to the AWS S3 Bucket in a compressed GZIP format. This data can then be ingested into whichever SIEM product your organization is using.

S3 Bucket Name

The first step to configure SIEM integration is to navigate to the Settings ➔ SIEM page. From here, you must provide the name of the AWS S3 Bucket to which you want the dope.cloud to send the log data.

Configuring the AWS S3 Bucket Policy

The AWS S3 bucket that you want to log data to be sent to must be configured to give the dope.cloud write access.

Within the SIEM integration page on the right-hand panel, dope.security has provided the policy that the AWS S3 Bucket needs to be configured with. You need to copy and paste this policy and use it to configure the organization’s AWS S3 Bucket.

Synchronise

Once the AWS S3 Bucket is configured correctly return to the Settings ➔ SIEM Page and simply click the Sync Button

When everything has been configured correctly a successful synchronization will be clearly indicated on the SIEM page.

A green tick will appear next to the AWS S3 Bucket name and the last synchronization time will appear on the top right of the page.

The Audit Log will have an event posted that shows the number of files that have not been sent to the organization's AWS S3 Bucket.

When connection to the AWS S3 Bucket is restored then the SIEM page will again indicate that the synchronization was successful. There will also be a connection returned event added to the Audit Log.

Log Data Format

The data is sent in JSONL format below you can find the JSON Schema and an example JSONL file.

Below is a description of each parameter in the JSONL file:

Method 2. Configuring the HTTP Integration

Currently DOPE HTTP Integration supports the following SIEM tools:

• Splunk

• QRadar

• Taegis

• MS Sentinel

• Crowdstrike

Splunk

To configure Splunk, you must have the HTTP Event Collector (HEC) URI and the token. The steps to obtain these can be found in Splunk's Enterprise Documentation: Set up and use HTTP Event Collector in Splunk Web.

In the dope.console, navigate to Settings ➔ SIEM ➔ SIEM Integration Settings ➔ HTTP. From here select "Splunk" as the SIEM type and update the HEC URI and the HEC token in the following SIEM HTTP settings page of the dope.console and sync.

In order to confirm that the sync is successful, you should see a couple of sample records in your SIEM as a validation test.

QRadar

To configure Taegis, you must have the Taegis integration URL and the integration key. The steps to obtain these can be found in IBM's QRadar Security Intelligence Platform Documentation: HTTP Receiver protocol configuration options.

In the dope.console navigate to Settings ➔ SIEM ➔ SIEM Integration Settings ➔ HTTP. From here select “QRadar” as the SIEM type and update the integration URL and the integration key and sync.

In order to confirm that the sync is successful, you should see a couple of sample records in your SIEM as a validation test.

Taegis

To configure Taegis, you must have the Taegis integration URL and the integration key. The steps to obtain these can be found in Securework's Documentation: Configure HTTP Ingest.

In the dope.console navigate to Settings ➔ SIEM ➔ SIEM Integration Settings ➔ HTTP. From here select “Taegis” as the SIEM type and update the integration URL and the integration key and sync.

In order to confirm that the sync is successful, you should see a couple of sample records in your SIEM as a validation test.

MS Sentinel

To integrate with Microsoft Sentinel using HTTP, you'll need to utilize the Azure Monitor Logs Ingestion API. The steps to configure this can be found in Azure Monitor's Documentation: Logs Ingestion API in Azure Monitor

Azure Prerequisites:

1. Register a Microsoft Entra application → copy Tenant ID, Client ID, and generate a Client Secret.

2. Create or select a Log Analytics workspace.

3. Add a Custom table called DopeSwg_CL; keep the default “Custom-DopeSwg” stream name.

4. Create a Data-Collection Endpoint (DCE) in the same region.

5. Create a Data-Collection Rule (DCR) that routes the Custom-DopeSwg_CL stream to your workspace. Record the DCR immutable ID.

6. Open the DCR → Access control (IAM) → add the Entra app to the Monitoring Metrics Publisher role (scope = this DCR)

Configure dope.console:

In the dope.console navigate to Settings ➔ SIEM ➔ SIEM Integration Settings ➔ HTTP.

Confirm the sync is successful when you see two sample validation records in your SIEM

Crowdstrike

To configure Crowdstrike, you must create a HEC Connector within your Crowdstrike console. First login to your Crowdstrike console and go to Data Onboarding. Then add a HEC Connector and add the dopesecurity-swg parser. Once this is saved you will be provided with an API key and an API URL, copy these so you can add them to the SIEM configuration in the dope console.

In the dope.console, navigate to Settings ➔ SIEM ➔ SIEM Integration Settings ➔ HTTP. From here select "Crowdstrike" as the SIEM type and update the API Token and the API URL token in the following SIEM HTTP settings page and sync.

In order to confirm that the sync is successful, you should see a couple of sample records in your SIEM as a validation test.