Splunk Dashboards

deviceTRUST includes a Splunk app to easily create a Splunk dashboard to monitor the contextual status of your remoting and DaaS environment.

The License Compliance Templates can be used with the Splunk app to monitor or enforce Device-Based Licensing requirements for one or more applications:

The Splunk Status Report Template can be used to monitor the status of your remoting and DaaS environment:

The following steps will be performed:

1. Step 1: Creating the Splunk Index
   1. Step 1.1: Manually creating the Splunk Index
   2. Step 1.2: Creating the Splunk Index by installing the app
2. Step 2: Creating the Splunk Data Inputs
3. Step 3: Importing the Splunk app
   1. Step 3.1: Downloading the Splunk app
   2. Step 3.2: Installing the Splunk app
4. Step 4: Configuring deviceTRUST
   1. Step 4.1: The Device-Based Licensing Report
   2. Step 4.2: The Status Report

Step 1: Creating the Splunk Index

Splunk collects data in indexes which holds the log data and make it searchable. There are different methods for working with indexes. Data can, for example, flow into one common index. Alternatively, multiple indexes can be created, one for each use case or scenario.

The deviceTRUST reports use one common index devicetrust for storing the data. The separation for the different uses cases is done by applying sourcetypes devicebasedlicensing and statusreport.

Our deviceTRUST reports are built on the described combination of index and sourcetypes. If your implementation differs, the reports will have to be adjusted accordingly. Make sure to let us know, we’ll happily assist.

You can either create the index devicetrust manually or by importing our prepared app dt_index.

Step 1.1: Manually creating the Splunk Index

Implementing the index manually does not require any special configuration.

• Open your Splunk management GUI
• Navigate to Settings\Indexes and click New Index.

• Set the name to devicetrust and all other options are optional.

• Click Save and the index will be created.

Step 1.2: Creating the Splunk Index by installing the app

To create the index from the app, please refer to Step 3.2: Installing the Splunk app within this guide. The app dt_index does not contain any elements besides the index definition for the index devicetrust.

Step 2: Creating the Splunk Data Inputs

Data is sent to the Splunk server by using REST API calls. Splunk needs to be configured to accept http-based inputs. An authentication token is generated, that will be added to the deviceTRUST Console configuration later.

• Open your splunk management GUI and navigate to Settings\Data Inputs.

• Select HTTP Event Collector
• Click `New Token

• Set a name of your choice.
• All other settings are optional.

Input settings does, for example, allow to restrict access for this data input to certain indexes. Any of these settings may be relevant for your environment. The function of the deviceTRUST reports will not be affected by setting them.

• Review the Settings.
• Click Submit.

• The created token is shown.

• The created token is also be displayed in the token overview page.

Additionally, the http input method has to be configured. In the most basic configuration, we make sure SSL is not active and all tokens are enabled.

These settings may differ in your environment. The function of the deviceTRUST reports will not be affected by setting them accordingly.

• Open your splunk management GUI and navigate to Settings\Data Inputs\HTTP Data Collector
• Click Global Settings
• Set All Tokens to Enabled.
• Set Enable SSL to Off.

Step 3: Importing the Splunk app

Step 3.1: Downloading the Splunk app

The deviceTRUST reports are delivered as Splunk apps. The apps is available from the deviceTRUST GitHub repository.

• Navigate to the repository and find the Splunk apps.

• The apps are provided as “spl” files which should be downloaded.

• Alternatively the “spl” files can be synchronized via the GIT command line.

• With the apps available locally, they can be imported into Splunk.

Step 3.2: Installing the Splunk app

All three deviceTRUST apps are installed the same way. Thus, the app installation is described by using one example.

• Open your Splunk management console.
• Click Manage Apps in the apps menu.

• Click Install app from file.

• Click Choose File.

• Select your app file.

• Confirming your selection.
• Optionally select to upgrade apps, if applicable.
• Click Upload.

• Splunk will ask to restart the service. This is only required after importing the last app.
• Choose Restart Now or Restart Later accordingly.

• The menu Apps\Manage Apps displays all apps that are installed in your Splunk environment.

Step 4: Configuring deviceTRUST

After the the index has been created, the data input object added and all apps have been imported, Splunk is ready to accept, store and compute data for the deviceTRUST reports.

As both reports Device-Based Licensing and Status Report differ in their details, both are described here separately.

Step 4.1: The Device-Based Licensing Report

This step describes the configuration to be added to the deviceTRUST Console to send Device-Based Licensing data to Splunk.

The integrated templates contain all elements that are required to fully configure the agent for the Device-Based Licensing of five example applications. These five example applications can be easily edited for your own applications, or cloned to represent new applications. The elements are contexts, actions, messages and settings.

• Open the deviceTRUST Console.
• Click Sharing in the top right menu. You may need to click Show Advanced View if this button is not visible.

• Select Import Template

• The report Device-Based Licensing can be found within the template category License Compliance when Remoting is selected.

• The category contains templates for different example applications. We use Adobe Acrobat DC as an example here.

Two contexts are included within the template:

• Adobe Acrobat DC Licensed Status to evaluate the device license status.
• Adobe Acrobat DC User to define if the accessing user is licensed to use the software.

Three actions are included within the template:

• Adobe Acrobat DC Licensed Device - Conditional Application Access - FSLogix App Masking is used for application control via FSLogix App Masking and can be ignored or deleted for the reporting use case.
• Adobe Acrobat DC Licensed Device - Conditional Application Access - Microsoft AppLocker is used for application control via Microsoft AppLocker and can be ignored or deleted for the reporting use case.
• Adobe Acrobat DC Licensed Device - Conditional Application Access - Reporting the only action required for reporting.

• The action contains uses the Web Request task to send data to Splunk. The Audit Event, Custom Process and also the Web Request tasks for ELK Stack and Graylog can be deleted, as we are configuring Splunk here.

• The Splunk Web Request task needs to be edited to suit your environment. If you do not require SSL transport, you’ll only have to configure your server’s fqdn and the authorization token (http data input). Make sure to leave the keyword splunk and only add/change your authorization token’s GUID.

The use case has successfully been configured. deviceTRUST will now send Device-Based Licensing data on every access to the Splunk server. The data will be presented using dashboards.

Step 4.2: The Status Report

This step describes the configuration, that is to be added to the deviceTRUST console to send Status Report data to splunk.

Our integrated templates contain all elements that are required to fully configure the agent for the Device-Based Licensing of five example applications. The elements are contexts, actions, messages and settings.

• Open the deviceTRUST console and click Sharing in the top right menu.

• Select Import Template

• The Status Report template can be found within the template category Status Report when Remoting is selected.

• This category contains templates for several ways of storing data. Choose Splunk.

• The imported template consists of 50 contexts and one action.
• The Action Status Report – Splunk collects all relevant data and sends them over to Splunk.

• Sending data to Splunk is configured by using a Web Request task.

The Web Request task needs to be edited to suit your environment. If you do not require SSL transport, you’ll only have to configure your server’s fqdn and the authorization token (http data input). Make sure to leave the keyword splunk and only change your authorization token’s GUID.

The use case has successfully been configured. deviceTRUST will now send Status Report data on every access to the remoting platform to the splunk server. There, the data will be presented using dashboards.