ArubaOS Switch

Overview

Aruba OS is the operating system developed by Aruba Networks, designed for their networking devices and infrastructure. It offers advanced features for wireless and wired networking, security, and management, enhancing network performance and reliability.

• Vendor: Aruba Networks
• Plan: Defend Core & Defend Prime
• Supported environment: On Premise
• Version compatibility: 16.10 (Latest version as of now)
• Detection based on: Telemetry
• Supported application or feature: Network management and performance monitoring

High-Level Architecture Diagram

• Type of integration: Outbound (PUSH to Sekoia.io)
• Schema

Specification

Prerequisites

• Resource:
  • Self-managed syslog forwarder
• Network:
  • Outbound traffic allowed
• Permissions:
  • Administrator or Root access to the ArubaOS device
  • Root access to the Linux server with the syslog forwarder

Transport Protocol/Method

• Indirect Syslog

Logs details

• Supported functionalities: See section Overview
• Supported type(s) of structure: Plain Text
• Supported verbosity level: Informational

Note

Log levels are based on the taxonomy of RFC5424. Adapt according to the terminology used by the editor.

Step-by-Step Configuration Procedure

Instructions on the 3rd Party Solution

This setup guide will show you how to forward your ArubaOS logs to Sekoia.io by means of a syslog transport channel.

Enable Syslog Forwarding for ArubaOS

• Log in to your ArubaOS device using SSH, Telnet, or the web-based management interface, depending on your preferred method.
• Access the configuration mode on your ArubaOS device. For example, if you are using the CLI, you might use the configure terminal command.

Configure Syslog Settings

• Use the following command to specify the syslog server's IP address:

  logging x.x.x.x
  

  Replace x.x.x.x with the IP address of your syslog concentrator.
• Additionally, you can specify the syslog server's UDP port using the port keyword:

  logging x.x.x.x port yyyy
  

  Replace yyyy with the port number your syslog concentrator is configured to listen on.

Set Log Severity Levels

• Configure the severity level of logs that will be sent to the syslog server.

  logging level informational
  

Save Configuration Changes

• Save your configuration changes by issuing the appropriate command (e.g., write memory or copy running-config startup-config) to ensure that the syslog configuration persists across reboots.

Test Syslog Forwarding (Optional)

• You can generate a test log entry to ensure that logs are being forwarded to the syslog server. For example, use the following command:

  logging x.x.x.x testing
  

  This will generate a test log message that should appear in your syslog server's logs.

Verify Syslog Server Configuration

• On your syslog server, verify that it is configured to accept syslog messages in UDP from the ArubaOS device on the specified port.

Instruction on Sekoia

Configure Your Intake

This section will guide you through creating the intake object in Sekoia, which provides a unique identifier called the "Intake key." The Intake key is essential for later configuration, as it references the Community, Entity, and Parser (Intake Format) used when receiving raw events on Sekoia.

1. Go to the Sekoia Intake page.
2. Click on the + New Intake button at the top right of the page.
3. Search for your Intake by the product name in the search bar.
4. Give it a Name and associate it with an Entity (and a Community if using multi-tenant mode).
5. Click on Create.
6. You will be redirected to the Intake listing page, where you will find a new line with the name you gave to the Intake.

Note

For more details on how to use the Intake page and to find the Intake key you just created, refer to this documentation.

Configure a forwarder

To forward events using syslog to Sekoia.io, you need to update the syslog header with the intake key you previously created. Here is an example of your message before the forwarder

<%pri%>1 %timestamp:::date-rfc3339% %hostname% %app-name% %procid% LOG RAW_MESSAGE

and after

<%pri%>1 %timestamp:::date-rfc3339% %hostname% %app-name% %procid% LOG [SEKOIA@53288 intake_key=\"YOUR_INTAKE_KEY\"] RAW_MESSAGE

To achieve this you can:

• Use the Sekoia.io forwarder which is the official supported way to collect data using the syslog protocol in Sekoia.io. In charge of centralizing data coming from many equipments/sources and forwarding them to Sekoia.io with the apporpriated format, it is a prepackaged option. You only have to provide your intake key as parameter.
• Use your own Syslog service instance. Maybe you already have an intance of one of these components on your side and want to reuse it in order to centralize data before forwarding them to Sekoia.io. When using this mode, you have to configure and maintain your component in order to respect the expected Sekoia.io format.

Warning

Only the Sekoia.io forwarder is officially supported. Other options are documented for reference purposes but do not have official support.

Raw Events Samples

In this section, you will find examples of raw logs as generated natively by the source. These examples are provided to help integrators understand the data format before ingestion into Sekoia.io. It is crucial for setting up the correct parsing stages and ensuring that all relevant information is captured.

test_auth_failtest_auth_successtest_dhcp_snooptest_dhcp_snoop_2test_mgrtest_other_1test_other_2test_other_3test_other_4test_other_5test_other_6test_other_7test_other_8test_snmptest_snmp_2test_sntptest_ssl_failtest_ssl_session_closed

auth:  ST1-CMDR: Invalid user name/password on SSH session User 'john.doe' is trying to login from 1.2.3.4

auth:  ST1-CMDR: User 'john.doe' logged in from 1.2.3.4 to SSH session

dhcp-snoop:  ST1-CMDR: backplane: Attempt to release address 3.4.5.6 leased to port Trk7 detected on port Trk8

dhcp-snoop:  ST1-CMDR: backplane: Ceasing bad release logs for 5m

mgr:  ST1-CMDR: SME SSH from 1.2.3.4 - MANAGER Mode

crypto:  ST1-CMDR: Certificate used by http-ssl application is expired.

dhcp-server:  ST1-CMDR: No IP addresses to offer from pool Adm-wifi (8 times in 60 seconds)

dhcp-server:  ST1-CMDR: High threshold reached for pool Adm-wifi. Active bindings: 2, Free bindings: 0

FFI:  ST1-CMDR: port 1/11-High collision or drop rate. See help.

ports:  ST1-CMDR: port 2/16 in Trk7 is now on-line

ports:  ST1-CMDR: port 2/16 is Blocked by LACP

ports:  ST1-CMDR: port 1/8 is now on-line

ports:  ST1-CMDR: port 1/8 is now off-line

snmp:  ST1-CMDR: Security access violation from 1.2.3.4 for the community name or user name : internal

snmp:  ST1-CMDR: Security access violation from 1.2.3.4 for the community name or user name : internal (1 times in 60 seconds)

SNTP:  ST1-CMDR: Updated time by 4 seconds from server at 1.2.3.4. Previous time was Mon Aug 28 11:53:06 2023. Current time is Mon Aug 28 11:53:10 2023.

ssl:  ST1-CMDR: User :TLS connection failed for WEB-UI session from 1.2.3.4. (1 times in 60 seconds)

ssl:  ST1-CMDR: SSL/TLS session closed for WEB-UI from 1.2.3.4.

Detection section

The following section provides information for those who wish to learn more about the detection capabilities enabled by collecting this intake. It includes details about the built-in rule catalog, event categories, and ECS fields extracted from raw events. This is essential for users aiming to create custom detection rules, perform hunting activities, or pivot in the events page.

Related Built-in Rules

The following Sekoia.io built-in rules match the intake ArubaOS Switch. This documentation is updated automatically and is based solely on the fields used by the intake which are checked against our rules. This means that some rules will be listed but might not be relevant with the intake.

SEKOIA.IO x ArubaOS Switch on ATT&CK Navigator

Cryptomining

Detection of domain names potentially related to cryptomining activities.

• Effort: master

Dynamic DNS Contacted

Detect communication with dynamic dns domain. This kind of domain is often used by attackers. This rule can trigger false positive in non-controlled environment because dynamic dns is not always malicious.

• Effort: master

Exfiltration Domain

Detects traffic toward a domain flagged as a possible exfiltration vector.

• Effort: master

RSA SecurID Failed Authentification

Detects many failed attempts to authenticate followed by a successfull login for a super admin account.

• Effort: advanced

Remote Access Tool Domain

Detects traffic toward a domain flagged as a Remote Administration Tool (RAT).

• Effort: master

SEKOIA.IO Intelligence Feed

Detect threats based on indicators of compromise (IOCs) collected by SEKOIA's Threat and Detection Research team.

• Effort: elementary

Sekoia.io EICAR Detection

Detects observables in Sekoia.io CTI tagged as EICAR, which are fake samples meant to test detection.

• Effort: master

TOR Usage Generic Rule

Detects TOR usage globally, whether the IP is a destination or source. TOR is short for The Onion Router, and it gets its name from how it works. TOR intercepts the network traffic from one or more apps on user’s computer, usually the user web browser, and shuffles it through a number of randomly-chosen computers before passing it on to its destination. This disguises user location, and makes it harder for servers to pick him/her out on repeat visits, or to tie together separate visits to different sites, this making tracking and surveillance more difficult. Before a network packet starts its journey, user’s computer chooses a random list of relays and repeatedly encrypts the data in multiple layers, like an onion. Each relay knows only enough to strip off the outermost layer of encryption, before passing what’s left on to the next relay in the list.

• Effort: master

Event Categories

The following table lists the data source offered by this integration.

Data Source	Description
Network device logs	None

In details, the following table denotes the type of events produced by this integration.

Name	Values
Kind	alert
Category	authentication, network, session
Type	connection, end, info, start

Transformed Events Samples after Ingestion

This section demonstrates how the raw logs will be transformed by our parsers. It shows the extracted fields that will be available for use in the built-in detection rules and hunting activities in the events page. Understanding these transformations is essential for analysts to create effective detection mechanisms with custom detection rules and to leverage the full potential of the collected data.

test_auth_fail.jsontest_auth_success.jsontest_dhcp_snoop.jsontest_dhcp_snoop_2.jsontest_mgr.jsontest_other_1.jsontest_other_2.jsontest_other_3.jsontest_other_4.jsontest_other_5.jsontest_other_6.jsontest_other_7.jsontest_other_8.jsontest_snmp.jsontest_snmp_2.jsontest_sntp.jsontest_ssl_fail.jsontest_ssl_session_closed.json

{
    "message": "auth:  ST1-CMDR: Invalid user name/password on SSH session User 'john.doe' is trying to login from 1.2.3.4",
    "event": {
        "category": [
            "authentication"
        ],
        "dataset": "auth",
        "reason": "Invalid user name/password on SSH session User 'john.doe' is trying to login from 1.2.3.4",
        "type": [
            "info"
        ]
    },
    "related": {
        "ip": [
            "1.2.3.4"
        ],
        "user": [
            "john.doe"
        ]
    },
    "source": {
        "address": "1.2.3.4",
        "ip": "1.2.3.4"
    },
    "user": {
        "name": "john.doe"
    }
}

{
    "message": "auth:  ST1-CMDR: User 'john.doe' logged in from 1.2.3.4 to SSH session",
    "event": {
        "category": [
            "authentication"
        ],
        "dataset": "auth",
        "reason": "User 'john.doe' logged in from 1.2.3.4 to SSH session",
        "type": [
            "start"
        ]
    },
    "related": {
        "ip": [
            "1.2.3.4"
        ],
        "user": [
            "john.doe"
        ]
    },
    "source": {
        "address": "1.2.3.4",
        "ip": "1.2.3.4"
    },
    "user": {
        "name": "john.doe"
    }
}

{
    "message": "dhcp-snoop:  ST1-CMDR: backplane: Attempt to release address 3.4.5.6 leased to port Trk7 detected on port Trk8",
    "event": {
        "category": [
            "network"
        ],
        "dataset": "dhcp-snoop",
        "reason": "backplane: Attempt to release address 3.4.5.6 leased to port Trk7 detected on port Trk8",
        "type": [
            "connection"
        ]
    },
    "related": {
        "ip": [
            "3.4.5.6"
        ]
    },
    "source": {
        "address": "3.4.5.6",
        "ip": "3.4.5.6"
    }
}

{
    "message": "dhcp-snoop:  ST1-CMDR: backplane: Ceasing bad release logs for 5m",
    "event": {
        "category": [
            "network"
        ],
        "dataset": "dhcp-snoop",
        "reason": "backplane: Ceasing bad release logs for 5m",
        "type": [
            "connection"
        ]
    }
}

{
    "message": "mgr:  ST1-CMDR: SME SSH from 1.2.3.4 - MANAGER Mode",
    "event": {
        "category": [
            "session"
        ],
        "dataset": "mgr",
        "reason": "SME SSH from 1.2.3.4 - MANAGER Mode",
        "type": [
            "start"
        ]
    },
    "related": {
        "ip": [
            "1.2.3.4"
        ]
    },
    "source": {
        "address": "1.2.3.4",
        "ip": "1.2.3.4"
    }
}

{
    "message": "crypto:  ST1-CMDR: Certificate used by http-ssl application is expired.",
    "event": {
        "category": [
            "network"
        ],
        "dataset": "crypto",
        "reason": "Certificate used by http-ssl application is expired.",
        "type": [
            "connection"
        ]
    }
}

{
    "message": "dhcp-server:  ST1-CMDR: No IP addresses to offer from pool Adm-wifi (8 times in 60 seconds)",
    "event": {
        "category": [
            "network"
        ],
        "dataset": "dhcp-server",
        "reason": "No IP addresses to offer from pool Adm-wifi (8 times in 60 seconds)",
        "type": [
            "connection"
        ]
    }
}

{
    "message": "dhcp-server:  ST1-CMDR: High threshold reached for pool Adm-wifi. Active bindings: 2, Free bindings: 0",
    "event": {
        "category": [
            "network"
        ],
        "dataset": "dhcp-server",
        "reason": "High threshold reached for pool Adm-wifi. Active bindings: 2, Free bindings: 0",
        "type": [
            "connection"
        ]
    }
}

{
    "message": "FFI:  ST1-CMDR: port 1/11-High collision or drop rate. See help.",
    "event": {
        "category": [
            "network"
        ],
        "dataset": "FFI",
        "reason": "port 1/11-High collision or drop rate. See help.",
        "type": [
            "connection"
        ]
    }
}

{
    "message": "ports:  ST1-CMDR: port 2/16 in Trk7 is now on-line",
    "event": {
        "category": [
            "network"
        ],
        "dataset": "ports",
        "reason": "port 2/16 in Trk7 is now on-line",
        "type": [
            "connection"
        ]
    }
}

{
    "message": "ports:  ST1-CMDR: port 2/16 is Blocked by LACP",
    "event": {
        "category": [
            "network"
        ],
        "dataset": "ports",
        "reason": "port 2/16 is Blocked by LACP",
        "type": [
            "connection"
        ]
    }
}

{
    "message": "ports:  ST1-CMDR: port 1/8 is now on-line",
    "event": {
        "category": [
            "network"
        ],
        "dataset": "ports",
        "reason": "port 1/8 is now on-line",
        "type": [
            "connection"
        ]
    }
}

{
    "message": "ports:  ST1-CMDR: port 1/8 is now off-line",
    "event": {
        "category": [
            "network"
        ],
        "dataset": "ports",
        "reason": "port 1/8 is now off-line",
        "type": [
            "connection"
        ]
    }
}

{
    "message": "snmp:  ST1-CMDR: Security access violation from 1.2.3.4 for the community name or user name : internal",
    "event": {
        "category": [
            "session"
        ],
        "dataset": "snmp",
        "kind": "alert",
        "reason": "Security access violation from 1.2.3.4 for the community name or user name : internal",
        "type": [
            "info"
        ]
    },
    "related": {
        "ip": [
            "1.2.3.4"
        ]
    },
    "source": {
        "address": "1.2.3.4",
        "ip": "1.2.3.4"
    }
}

{
    "message": "snmp:  ST1-CMDR: Security access violation from 1.2.3.4 for the community name or user name : internal (1 times in 60 seconds)",
    "event": {
        "category": [
            "session"
        ],
        "dataset": "snmp",
        "kind": "alert",
        "reason": "Security access violation from 1.2.3.4 for the community name or user name : internal (1 times in 60 seconds)",
        "type": [
            "info"
        ]
    },
    "related": {
        "ip": [
            "1.2.3.4"
        ]
    },
    "source": {
        "address": "1.2.3.4",
        "ip": "1.2.3.4"
    }
}

{
    "message": "SNTP:  ST1-CMDR: Updated time by 4 seconds from server at 1.2.3.4. Previous time was Mon Aug 28 11:53:06 2023. Current time is Mon Aug 28 11:53:10 2023.",
    "event": {
        "category": [
            "network"
        ],
        "dataset": "SNTP",
        "reason": "Updated time by 4 seconds from server at 1.2.3.4. Previous time was Mon Aug 28 11:53:06 2023. Current time is Mon Aug 28 11:53:10 2023.",
        "type": [
            "connection"
        ]
    },
    "related": {
        "ip": [
            "1.2.3.4"
        ]
    },
    "source": {
        "address": "1.2.3.4",
        "ip": "1.2.3.4"
    }
}

{
    "message": "ssl:  ST1-CMDR: User :TLS connection failed for WEB-UI session from 1.2.3.4. (1 times in 60 seconds)",
    "event": {
        "category": [
            "session"
        ],
        "dataset": "ssl",
        "reason": "User :TLS connection failed for WEB-UI session from 1.2.3.4. (1 times in 60 seconds)",
        "type": [
            "info"
        ]
    },
    "related": {
        "ip": [
            "1.2.3.4"
        ]
    },
    "source": {
        "address": "1.2.3.4",
        "ip": "1.2.3.4"
    }
}

{
    "message": "ssl:  ST1-CMDR: SSL/TLS session closed for WEB-UI from 1.2.3.4.",
    "event": {
        "category": [
            "session"
        ],
        "dataset": "ssl",
        "reason": "SSL/TLS session closed for WEB-UI from 1.2.3.4.",
        "type": [
            "end"
        ]
    },
    "related": {
        "ip": [
            "1.2.3.4"
        ]
    },
    "source": {
        "address": "1.2.3.4",
        "ip": "1.2.3.4"
    }
}

Extracted Fields

The following table lists the fields that are extracted, normalized under the ECS format, analyzed and indexed by the parser. It should be noted that infered fields are not listed.

Name	Type	Description
event.category	keyword	Event category. The second categorization field in the hierarchy.
event.dataset	keyword	Name of the dataset.
event.kind	keyword	The kind of the event. The highest categorization field in the hierarchy.
event.reason	keyword	Reason why this event happened, according to the source
event.type	keyword	Event type. The third categorization field in the hierarchy.
source.ip	ip	IP address of the source.
user.name	keyword	Short name or login of the user.

For more information on the Intake Format, please find the code of the Parser, Smart Descriptions, and Supported Events here.

Further readings

• ArubaOS documentation