• Overview
• SIEM guides
• Prerequisites
• Step 1: Store the API key as a Cribl secret
• Step 2: Create the REST Collector
• Step 3: Create the Event Breaker
• Step 4: Run a test collection
• Step 5: Schedule the Collector
• Step 6: Send events to your SIEM
• Related

Overview

The Cloud Secure Edge (CSE) Command Center retains events for 14 days. To keep events longer, or to analyze them alongside other security data, send them to a Security Information and Event Management (SIEM) system.

Many SIEMs cannot poll a REST API on their own. Cribl Stream fills that gap: it pulls events from the CSE Events API on a schedule, shapes them, and forwards them to the SIEM of your choice. No custom code or scripts are required.

The pipeline works as follows:

1. A Cribl REST Collector calls the CSE Events API on a schedule and requests only the events created during the current time window.
2. A Cribl Event Breaker splits each API response into individual events and sets the event time from the created_at field.
3. A Cribl Route sends the events to a Destination that delivers them to your SIEM.

This page covers the CSE side of the pipeline, up to the point where events leave Cribl Stream. Setting up the Cribl Destination and the SIEM is covered in the guide for each SIEM.

SIEM guides

Note: For every destination that Cribl Stream can deliver to, see Destinations in the Cribl documentation.

Prerequisites

• A read-only CSE API key. See Step 1: Create a read-only API key.
• A Cribl Stream deployment, either Cribl.Cloud or self-managed, with permission to create Secrets, Collectors, and Routes.
• Outbound HTTPS access from Cribl Stream to your Command Center: net.banyanops.com, or eucc.console.banyanops.com for the European (EUCC) Command Center.
• A SIEM that Cribl Stream can reach, and the matching Cribl Destination. See the guide for your SIEM.

Step 1: Store the API key as a Cribl secret

1.1 Log in to Cribl Stream.

1.2 In the left pane, open Worker Groups and select the default Worker Group.

Note: Cribl Stream trial deployments must use the default Worker Group. With a Cribl Enterprise license, create a dedicated Worker Group for this integration instead.

1.3 Navigate to Worker Group Settings > Security > Secrets, and select Add Secret.

1.4 Configure the secret:

• Secret ID: cse_api_key
• Secret type: Text
• Value: the CSE read-only API key

1.5 Select Save.

Step 2: Create the REST Collector

2.1 Select Data > Sources.

2.2 Under Collectors, select the REST collector type, and select Add Collector.

2.3 Configure the Collector:

Enter the Collect URL exactly as shown, including the enclosing backticks. Cribl Stream evaluates it as a JavaScript template literal and converts the earliest and latest times of each collection window from seconds to the milliseconds that the Events API expects.

Note: For the European (EUCC) Command Center, replace net.banyanops.com in the Collect URL with eucc.console.banyanops.com.

2.4 Under Collect headers, add one header named Authorization with the following value, including the backticks:

`Bearer ${C.Secret('cse_api_key', 'text').value}`

2.5 Set Pagination to Offset/Limit, and configure the following:

Pagination makes Cribl Stream keep requesting the next page of events until none are left, instead of stopping after the first page. Without it, a window that holds more events than the record limit returns only the first page, and the remaining events are lost without any error.

2.6 Open the Advanced Settings section, and turn on Stop on empty results.

2.7 Save the Collector. You return to it in Step 3.

Step 3: Create the Event Breaker

The Events API returns one JSON object that contains a data array. The Event Breaker splits that array into one Cribl event per CSE event.

3.1 Navigate to Processing > Knowledge > Event Breaker Rulesets, and select Add Ruleset.

3.2 Enter the ID cse_events_breaker, select Add Rule, and configure the rule:

Note: Enter the Timestamp anchor exactly as shown, and set Default timezone to UTC. CSE timestamps are epoch values. If the time zone is set to local time, Cribl Stream can shift the event time by several hours.

3.3 Save the ruleset.

3.4 Return to the cse_events REST Collector under Data > Sources.

3.5 Under Results, select Add Ruleset, and select the cse_events_breaker ruleset.

3.6 Save the Collector.

Step 4: Run a test collection

4.1 In the Collector list, select Run for the cse_events Collector.

4.2 Select Preview mode, and set the time range, for example Earliest -1h and Latest now.

4.3 Select Run. The preview lists individual events. Hover over an event’s _time value to see the event time in UTC and in your local time. The event time matches the time of the same event in the CSE Command Center.

Step 5: Schedule the Collector

5.1 In the Collector list, select Schedule for the cse_events Collector.

5.2 Turn on Enabled, and configure the schedule:

These values collect a five-minute window of events every five minutes. Each window ends one minute in the past, so events that are still being written are collected by the next run instead of being missed.

Keep the window equal to the interval. The Collector discards any event whose time falls outside the Earliest and Latest range, even in a full run. If you change the schedule interval, change the window to match. A window shorter than the interval creates gaps, and a window longer than the interval creates duplicates.

Note: With pagination on, a busy window is collected in several requests. A very busy organization may need a longer interval, so that each run finishes before the next one begins.

Missed and failed runs are not collected again. Each run collects only its own window. If a run fails, for example because the Events API keeps returning errors after the Collector’s retries, no later run collects that window. The same happens when Cribl Stream skips a run. It skips a run that is still waiting for the previous run when the next run is due, if Skippable is on. It also skips runs while it is shut down, unless Resume missed runs is on. To recover a window, run the Collector in Full Run mode with Earliest and Latest set to the missed period. The Command Center keeps events for 14 days, so recover a window within 14 days.

5.3 Save the schedule.

5.4 Select Commit & Deploy to push the changes to production.

Step 6: Send events to your SIEM

Create the Destination and Route for your SIEM by following its guide under SIEM guides.

Related

• Event Properties and Definitions, for the fields in each event
• Retrieve Events with the API, for how the Events API pages results