>
>

Security Information and Event Management (SIEM) Integration

Updated

NP-View has the capability to send the Asset Inventory report to Elastic Search or Splunk as well as query these systems and get search results.

Configuring the Connection

Under the System Manager menu, select Notification Manager.

Select the Configure Services tab and the service to configure. Then input the connection information for that service.

Click the 'Save Service' button to save the configuration.

One configured the services will be marked with a check mark as shown above.

Enabling Asset Reports to Send

Within each workspace and view, individual asset inventory reports can be enabled to send to Elastic or Splunk. When the Asset Inventory report is opened, using the hamburger menu, select the ‘Send on Schedule’ toggle. This will enable a specific report to be sent on demand or on a schedule.

Send on Demand or Schedule

Using the topology settings menu,

The user can schedule to send the Asset Inventory report to Splunk or Elastic (but not both) on demand

or a schedule.

They can also select to send the report at any time by clicking the 'Send Now Button'.

Sending a Query to a SIEM

The user can send a structured query to Splunk or Elastic Search using the 'Query Services' panel under the System menu.

Clicking 'Launch Query Services' will open a query panel in a new tab where the user can select to submit a query to Splunk or Elastic Search.

The query results will be delivered to the results panel.