Skip to main content

Forward threats and events to your Darktrace Network environment.

Integrating with Darktrace Network

Keep Aware can forward threats and events to your Darktrace Network environment. Once events are in the Darktrace platform, they can be utilized alongside advanced searching, enriching event logs and investigations, and for model breaches.

Requirements​

  1. Access to the Keep Aware Console: Access to the console and permissions for creating and modifying integrations.
  2. Darktrace Network: Access to your Darktrace console, along with a connected Darktrace vSensor for receiving the events from Keep Aware.
  3. Darktrace vSensor Public IP: The public IP address for your Darktrace vSensor.
  4. Darktrace vSensor SSL Certificate: The SHA1/SHA256 fingerprints for your Darktrace vSensor SSL certificate.

Getting Started​

To connect Keep Aware to your Darktrace environment, navigate to the Integrations page from the menu on the left side of your console. Additionally, sign into your Darktrace master instance associated with the vSensor that you will send events to.

View In Console

Configure your vSensor​

In your Darktrace console, verify your vSensor is configured properly, and that you have the requested information above. To setup a vSensor, refer to your Darktrace Customer Portal. Once configured, add the following Keep Aware Public IP Address as an allowed IP address for Log Inputs. In your Darktrace console:

  1. Access the Darktrace master instance associated with the vSensor. Within the Threat Visualizer, navigate to the System Config page in the main menu under Admin. Select Modules from the left-hand menu.
  2. In the Telemetry section, click the Config button. A new dialog will open.
  3. Select the vSensor that logs will be sent to. In the field Log Input Allowed IPs, enter the following IP address: 52.89.186.180

Creating a Darktrace Telemetry Template​

Darktrace can use a custom telemetry template to correctly parse Keep Aware events in real-time. For more detailed information on log input templates, see Log Ingestion Templates (Darktrace Customer Portal).

  1. A template must now be defined for the logs to be parsed. Remaining within the "Telemetry" subsection, click the plus (+) icon to create a new template. Each template requires a name, a type, a log filter and a pattern.
  2. Use the name KeepAware for your template. Set the type to "Custom Event".
  3. Set the filter for the pattern to KeepAware.
  4. Now, create the pattern to parse the data in using the built-in expressions. To use Keep Aware's recommended pattern, use the entry below:
.*%{TIMESTAMP_ISO8601:time}\s%{DATA:sourcehostname} KeepAware.*IP=%{IP:src},.* Location=%{HOSTNAME:hostname}, Labels=%{GREEDYDATA:message}, Description=%{GREEDYDATA:details}.*, Severity=%{NUMBER:size}

Logs are sent from the vSensor in batches so it may take a short while for logs to appear using the new pattern.

Creating the Integration​

In your Keep Aware console, select the Darktrace Network integration. This will open a modal where you can select Create New Integration and begin configuring the integration.

Configure each of the fields below before creating the integration:

  • Identifier: A unique name for your Darktrace integration.
  • Darktrace vSensor IP: Your vSensor public IP address
  • Port: 6514
  • SHA1 / SHA256 fingerprints: For encrypted log ingestion, the SHA1 and SHA256 fingerprints of the current certificate are available in the certificate tooltip on the System Config page or can also be found on Status page.
  • Syslog Message: The syslog message will determine the information you send from Keep Aware to Darktrace. The recommended syslog pattern is provided below; however, any event fields can be sent to Darktrace. See Event and Threat Fields.
<46>{{@timestampISO}} {{device.hostname}} KeepAware[0]: IP={{device.ipAddress}}, User={{device.user}}, Location={{location}}, Labels={{policy.label}}, Description=A(n) {{type}} policy triggered for location {{location}}, Severity={{score}}

Once you save your integration, you will be ready to forward events or threats of interest from Keep Aware to Darktrace.

Results​

Once configured, you will have Keep Aware events and metadata available to various portions of your Darktrace platform.

  1. Advanced Search: (@type:*KeepAware*)
  2. Event Logs for Investigations and Devices
  3. KeepAware Custom Event type in the Darktrace Model Editor

Frequently Asked Questions​

QuestionAnswer
Do a need a vSensor?It is recommended to use a Darktrace vSensor for this integration so that you don't expose your Darktrace master application over a public IP address.
What IP and Ports do I need to make exceptions for?Keep Aware will forward encrypted events from 52.89.186.180 to your Darktrace vSensor public IP over TCP port 6514.
How can I find out what Event and Threat fields can be used in the syslog payload sent to Darktrace?All available Threat and Even fields are described and documented in the Event and Threat Fields Documentation

Table of Contents