SIEM Integrations

SIEM Integrations

Export NEURO findings to your Security Information and Event Management (SIEM) platform for centralized monitoring and correlation.

Splunk Integration

Export findings to Splunk via HTTP Event Collector (HEC).

Requirements

• Splunk instance with HEC enabled
• HEC token with appropriate permissions
• Network connectivity to Splunk

Configuration

1. Enable HEC in Splunk

   • Settings → Data Inputs → HTTP Event Collector
   • Create new token for NEURO

2. Configure in NEURO

   • Go to Settings → Integrations → SIEM
   • Select Splunk
   • Enter HEC URL (e.g., https://splunk.example.com:8088)
   • Enter HEC Token
   • Click Test Connection
   • Click Save

Exporting Findings

1. Go to Findings page
2. Select findings to export
3. Click Export → Splunk
4. Choose index (or use default neuro_findings)
5. Click Export

Splunk Search

Search Splunk from within NEURO:

1. Go to Settings → Integrations → SIEM
2. Click Search Splunk
3. Enter SPL query
4. View results

Event Format

Findings are exported as JSON events:

{
  "event": {
    "finding_id": "uuid",
    "title": "SQL Injection",
    "severity": "critical",
    "status": "open",
    "project": "Web App Assessment",
    "client": "Acme Corp",
    "cvss_score": 9.8,
    "cve_ids": ["CVE-2024-1234"],
    "affected_assets": ["https://example.com/api"]
  },
  "sourcetype": "neuro:finding",
  "index": "neuro_findings"
}

---

Elasticsearch Integration

Export findings to Elasticsearch for indexing and visualization with Kibana.

Requirements

• Elasticsearch cluster (7.x or 8.x)
• Write access to target index
• Network connectivity

Configuration

1. Configure in NEURO
   • Go to Settings → Integrations → SIEM
   • Select Elasticsearch
   • Enter cluster URL (e.g., https://elastic.example.com:9200)
   • Enter authentication (API key or username/password)
   • Click Test Connection
   • Click Save

Creating Indexes

Create an index with proper mappings:

1. Go to Settings → Integrations → SIEM
2. Click Create Index
3. Enter index name
4. NEURO creates index with appropriate field mappings

Exporting Findings

1. Go to Findings page
2. Select findings to export
3. Click Export → Elasticsearch
4. Choose index
5. Click Export

Document Format

Findings are indexed as documents:

{
  "finding_id": "uuid",
  "title": "SQL Injection",
  "severity": "critical",
  "status": "open",
  "project_id": "uuid",
  "project_name": "Web App Assessment",
  "client_name": "Acme Corp",
  "cvss_score": 9.8,
  "cve_ids": ["CVE-2024-1234"],
  "cwe_ids": ["CWE-89"],
  "affected_assets": ["https://example.com/api"],
  "created_at": "2026-01-19T12:00:00Z",
  "updated_at": "2026-01-19T12:00:00Z",
  "@timestamp": "2026-01-19T12:00:00Z"
}

Kibana Dashboards

Import pre-built Kibana dashboards:

1. Download dashboard JSON from NEURO docs
2. Import in Kibana → Stack Management → Saved Objects
3. Configure index pattern

---

Use Cases

Security Operations Center

• Real-time finding alerts
• Correlation with other security events
• SLA tracking and escalation

Compliance Reporting

• Audit trail of all findings
• Remediation timeline tracking
• Executive dashboards

Threat Intelligence

• CVE correlation across systems
• Attack pattern analysis
• Trend identification

---

Next: API Integration