Ticketing Tool Integration

With Log360 UEBA, you can efficiently manage security incidents by raising tickets for alerts that are generated.

Configure Ticketing Tool

Under the Alerts tab, click on the icon and choose Ticketing Tool Integration to configure an external help desk - ServiceNow, Jira Service Desk, Zendesk, Kayako, or ManageEngine AlarmsOne. Then, follow the following steps based on the ticketing tool used.

For ServiceNow:

To configure Log360 UEBA with ServiceNow

1. Enter the ServiceNow Sub Domain name.
2. Enter the login name and password of a valid account in the ticketing tool.
3. Enter a short description and a description for the alert. You can select them from a predefined list available under Macros or type your own descriptions.
4. Click the Test and Save button to establish communication and complete configuration.

For Jira Service Desk:

To configure Log360 UEBA with Jira Service Desk, you would first need to get a few details from your Jira ticketing tool.

1. After logging into your Jira Service Desk account, click the settings icon on the top right corner and select Projects.
2. In the project list, note down the Key corresponding to the project in which you want your tickets to be raised.
3. Navigate to the Issues tab and reenter your username and password when prompted.
4. Note down the type of issues that the particular project can hold. The issues raised from Log360 UEBA should have the same type for a ticket to be successfully raised in Jira Service Desk.
5. Close Jira Service Desk and open Log360 UEBA to complete the configuration process.

To configure Log360 UEBA with Jira Service Desk:

1. Enter the Jira Service Desk server name or IP address.
2. Enter the port number.
3. Choose the protocol for communication - HTTP/HTTPS. If you choose HTTPS, please ensure you have imported the ticketing tool's SSL certificate in to Log360 UEBA's JRE Certificate store before configuring Jira Service Desk.
4. Enter the login name and password of the account having admin privileges.
5. Enter the project ID. This is the Key of the particular project noted from the ticketing tool.
6. Enter the type of issue. This needs to be the same as the issue type that the project has been configured to hold.
7. Enter a summary and description for the alert. You can select it from a predefined list available under Macros.
8. Click the Test and Save button to establish communication and complete configuration.

For Jira Service Desk (Cloud)

To configure Log360 UEBA with Jira Service Desk (Cloud)

1. Enter the Jira Sub Domain name.
2. Enter the valid Email ID.
3. Enter the API key. You can also follow the guide available there to generate the API key.
4. Enter the associated Project ID.
5. Enter the type of issue
6. Enter the Username
7. Enter a Summary (short message for the alert) and a Description about the alert. You can use the Macros for a predefined list of summaries and descriptions.
8. Click the Test and Save button to establish communication and complete configuration.

For Zendesk (using OneAuth authentication)

To configure Log360 UEBA with Zendesk, you would first need to get a few details from your Zendesk ticketing tool.

1. In Admin Center, click on Apps and integrations in the sidebar, then select APIs > Zendesk APIs.
2. Click the OAuth Clients tab on the Zendesk API page, and then click Add OAuth client on the right side of the OAuth client list.
3. Enter the client name, description, and name of the company. Select a logo.
4. The value that appears corresponding to Unique Identifier needs to be saved in a separate document. This would be needed while configuring Zendesk in Log360 UEBA.
5. Once you click Save, a secret code will appear above the Save button. Click Copy and save it in a separate document. This would also be needed while configuring Zendesk in Log360 UEBA.
6. Click Close and open Log360 UEBA to complete the configuration process.

From the Ticketing Tool drop-down list, select Zendesk.

1. Enter the Zendesk subdomain name.
2. Enter the Login Name and Password of a valid account in the ticketing tool.
3. Enter the Client ID in the corresponding field. This is value of the Unique Identifier noted from the ticketing tool.
4. Enter the Client Secret ID in the corresponding field. This is the value of the secret code obtained from the ticketing tool.
5. Enter a subject and a message for the alert. You can select them from a predefined list available under Macros or type your own.
6. Click the Test and Save button to establish communication and complete configuration.

For Zendesk (using Basic API authentication)

To configure Log360 UEBA with Zendesk:

1. Enter the Zendesk subdomain name.
2. Choose the Basic API authentication method.
3. Enter a valid Email ID.
4. Enter the valid API key. You can use the link available to generate an API key.
5. Enter a subject and message to describe the alert. You can use the Macros to access a predefined list of alert subjects and messages.
6. Click the Test and Save button to establish communication and complete configuration.

For ManageEngine AlarmsOne:

To configure Log360 UEBA with ManageEngine AlarmsOne:

1. Open Log360 UEBA's Ticketing Tool Integration page and select ManageEngine AlarmsOne in the Ticketing Tool field.
2. Now, enter the Webhook URL. You can generate the webhook URL using the link next to the field.
3. Enter a subject and a message for the alert. You can select them from a predefined list available under Macros or type your own.
4. Click the Test and Save button to establish communication and complete configuration.

For Kayako:

To configure Log360 UEBA with Kayako:

1. Enter the Kayako subdomain name.
2. Enter a valid Email ID and password in the ticketing tool.
3. Enter a subject and message for the alert. You can select the subject and messages from a predefined list available under Macros.
4. Click the Test and Save button to establish communication and complete configuration.

Alerts Tab

After successfully configuring the ticketing tool of choice, the Alert profiles configuration page should look something like this. You can select alert profiles in the ticketing tool configuration, and a ticket will automatically be raised in the configured ticketing tool when the corresponding alert is triggered in Log360 UEBA. Once you've completed selecting the alert profiles, click Update. You can also view the Connection Status and the associated server of the configured Ticketing tool.

How to import SSL Certificate into Log360 UEBA.

You will have to import the SSL certificate of the ticketing tool into Log360 UEBA's JRE certificate store when you opt for a HTTPS connection.

To import the certificate into Log360 UEBA's certificate store, follow the steps below:

1. Place your ticketing tool server's certificate in your browser's certificate store by allowing trust when your browser throws up an error saying that the certificate is not trusted.

Skip this step if your ticketing tool webpage is accessible.

2. Export the certificate of your ticketing tool as a DER/CER/PEM file from your browser.
   • Chrome: On the ticketing tool webpage, click on warning icon in the address bar → Certificate → Details tab → Copy to File... → Select DER → Save file
   • Internet Explorer: On the ticketing tool webpage, click on shield icon in the address bar → View certificates → Details tab → Copy to File... → Select DER → Save file
   • Firefox: On the ticketing tool webpage, click on padlock icon in the address bar → Right Arrow → More Information → Security → View certificate → Download file
3. Use the keytool utility to import the certificate into Log360 UEBA's JRE certificate store.

   Use the command:

   keytool -import -alias <ticketing-tool-server-name> -keystore <Log360 UEBA installation directory>/lib/security/cacerts -file <path-to-certificate-file>

   Enter the keystore password. Note that the default password is changeit