Configuring SLS

SLS embeds a Security Orchestration, Automation and Response (SOAR) engine, with which automatic responses to some incidents can be configured. This is disabled by default. To enable it:

1. Go to Settings > System Settings > General.

2. Select Enable SOAR in SLS.

3. Click on Save.

You will then need a SOAR license:

1. Contact Stormshield, and provide your hardware key. This key can be found in Settings > System Settings > Licenses.

2. Once you have obtained the license, click on Upload Licence on the same page.

3. Select SOAR.

4. Click on Browse and select your license.

5. Accept the terms of the end user license agreement.

6. Click on Submit.

For more information on enabling SOAR, refer to the SLS SOAR quickstart guide.

To import the SOAR package named soar.xdr.X.Y.Z-YYMMa.zip (the naming system is the same as the one used with the scenario package) from the scenario package, go to Settings > SOAR Settings > Import/Backup and click on Upload New File.

This package contains the configuration of playbooks, triggers and all SOAR settings, such as instances and their templates.

For more information on configuring SOAR, refer to the SLS SOAR configuration guide.

NOTE
After the Stormshield SOAR package is imported into SLS, default instances will be available for SNS, SMC and SES. To locate them, go to Settings > SOAR Settings > Playbook Integrations and search for SNS, SMC or SES in the search bar. Edit values by clicking on them. New instances can also be created from templates.

Creating SNS instances

1. In Settings > SOAR Settings > Playbook Integrations > Manage integrations, click on the Stormshield Network Security template.

2. Indicate the following parameters:

   • username_base64: SNS administrator's user name in base64,

   • password_base64: SNS administrator's password in base64,

     NOTE
     The SNS administrator account entered in these fields must hold read and write privileges on filter rules and objects.

   • fqdn: FQDN or IP address of the SNS instance,

   • port: default SNS listening port.

Creating SMC instances

1. In Settings > SOAR Settings > Playbook Integrations > Manage integrations, click on the Stormshield Management Center template.

2. Indicate the following parameters:

   • api_key: SMC API key,

   • fqdn: FQDN of the SMC instance.

Creating SES instances

1. In Settings > SOAR Settings > Playbook Integrations > Manage integrations, click on the Stormshield Endpoint Security template.

2. Indicate the following parameters:

   • api_key: SES API key,

   • fqdn: FQDN of the SES backend.

1. In Settings > Configuration > Normalization policies, select the stormshield policy.

2. Ensure that StormshieldCompiledNormalizer and StormshieldEndpointSecurityNormalizer have been selected in the right side of the Compiled normalizer.

3. Click on Submit.

1. Go to Settings > Configuration > Enrichment Source.

2. If there are files from an earlier version of the scenario package that have the same names as the files you are about to import, delete the older files by clicking on the bin icon.

3. Click on Add.

4. Select CSV from the menu on the left.

5. Enter SES_Alllogs in the Name field and select semicolon-separated in the Delimiter field.

6. Click on Browse, select the file SES_AllLogs.csv from the scenario package, and click on Upload.

7. Click on Save.

8. Repeat the process for the SNS_Alarms.csv file by entering SNS_Alarms in the Name field

1. Go to Settings > Knowledge Base > Lists and Tables.

2. Select Tables from the drop-down menu on the top left side and click on Add.

3. Create a table entitled THREATS_TABLE with entries having a lifetime of 30 minutes, then click on Save.

4. Create a table entitled THREATS_TABLE_12H with entries having a lifetime of 12 hours, then click on Save.

5. Create a table entitled TRIGGERED_ALARMS_TABLE with entries having a lifetime of 30 minutes, then click on Save.

6. Create a table entitled HOSTS_TABLE with entries having a lifetime of 12 hours, then click on Save.

1. Go to Settings > Knowledge Base > Macros.

2. If there are files from an earlier version of the scenario package that have the same names as the files you are about to import, delete the older files by clicking on the bin icon.

3. Click on Import.

4. Import the file macros.xdr.xxx.pak from the scenario package.

5. Click on Submit.

1. Go to Settings > Knowledge Base > Alert Rules and click on Import.

2. Import the file alertrules.xdr.xxx.pak from the scenario package.

3. You can click on the bell to enable notifications. For more information, refer to the section Creating Incident from Alert Rule in the SLS alerts and incidents guide.

4. Click on Submit.

WARNING
Alert rules belong to the account that imported them, and it is the only account that is allowed to view the incidents arising from these rules. We strongly recommend that you share these rules with SLS user groups, by clicking on the small arrow to enable sharing.

Imported rules can be seen in the My rules section, which can be accessed from the drop-down list at the top of the page.

Incidents will now appear in the Incident menu when alert rules are triggered.

The SOAR engine relies on lists of pre-programmed actions in reaction to events, known as playbooks. When an incident occurs, SLS suggests running a playbook in response to the incident. Playbooks are manually activated by default, but they can be automated. To do so, go to Playbooks > Triggers, and enable XDR-Alarm-Trigger. Access the list of playbooks by clicking on the Playbooks button in the menu on the left. For more information on playbooks and how to use them with SLS, refer to the SLS Playbook guide.

When you imported the package soar.xdr.X.Y.Z-YYMMa.zip, the playbooks and sub-playbooks in the table below were automatically created in SLS. When an incident occurs, the playbook XDR - Alarms hub will always be the first to be activated. Next, it will call up the playbook corresponding to the incident that follows the name of the triggered SLS alert.

Playbook descriptions

Description of sub-playbooks