lumutools/universal-siem

•Updated 3 months ago

Image

2.8K

lumutools/universal-siem repository overview

⁠Lumu - Universal SIEM SecOps Integration

Lumu Defender offers a framework to help you leverage Lumu's integrations with your existing cybersecurity stack, including Security Information and Event Management (SIEM); Security Orchestration, Automation, and Response (SOAR); Endpoint Detection and Response (EDR); incident response systems; and more.

The Lumu Universal SIEM Out-of-the-Box integration allows you to centralize Lumu detections and operating events in your SIEM deployment. With this information in your SIEM, you will be able to use Lumu input as a pivot for:

Incident response research

Post-mortem investigation

Threat hunting activities

For detailed infomation, please visit Lumu docs⁠.

⁠Getting started

This guide shows you how to use this project to feed your SIEM deployment with Lumu's confirmed compromises and operating events. Choose one of the following methods to forward Lumu events:

Syslog forwarding⁠
HTTP Collector⁠

⁠Requirements

Before running this project, familiarize yourself and set up the Lumu Universal SIEM SecOps Out-of-the-box integration in your Lumu portal. See more at Lumu docs⁠.

To run this project, you'll need docker installed in the machine where you intend to run it.

Docker⁠

⁠Syslog forwarding

Use this method if your SIEM supports event ingestion via Syslog. Lumu Universal SIEM can deliver Syslog messages in one of these formats:

RFC 5424
RFC 3164

⁠RFC 5424

The RFC 5424 Syslog standard follows this format:

<PRI>VERSION TIMESTAMP HOSTNAME APP-NAME PROC-ID MSGID STRUCTURED-DATA MESSAGE

Here's an example of a Lumu RFC 5424 Syslog message:

<150>1 2026-04-17T13:18:10.599Z 63535e56278b lumu-incs 7 d593b880465045669c101437482ae635 - {"IncidentUpdated": {"companyId": "...", "incident": {"id": "...", "timestamp": "2026-04-17T12:11:26.346Z", "status": "open", "statusTimestamp": "2026-04-17T12:11:26.346Z", "incidentGroupingFields": {"adversary": "tactip.cyou"}, "detectorType": "activity", "incidentType": "malicious-infrastructure", "totalEvents": 5, "firstEvent": {"timestamp": "2026-04-17T12:10:52.328Z", "id": "7a937a80-3a56-11f1-a391-773b17b641c9"}, "lastEvent": {"timestamp": "2026-04-17T13:17:53.256Z", "id": "d73c6680-3a5f-11f1-a3a0-773b17b641c9"}, "adversaryTypes": ["Malware"], "description": "Malware family Lumma stealer", "environmentStats": [{"environment": {"id": "36222", "type": "network-label", "label_name": "Lab_CR", "label_relevance": "High"}, "count": 4}, {"environment": {"id": "27713", "type": "network-label", "label_name": "epmLow", "label_relevance": "Low"}, "count": 1}], "counts": {"endpointTargetsCount": 4, "userTargetsCount": 0, "otherTargetsCount": 0, "totalTargetsCount": 4, "offendersCount": 1}, "offendersSamples": [{"_id": "tactip.cyou", "type": "network-location", "value": "tactip.cyou"}], "targetsSamples": [{"_id": "CARLOS-WIN10|36222", "type": "network-endpoint", "label": "36222", "name": "CARLOS-WIN10", "endpoint_ip": "77.227.136.33", "label_name": "Lab_CR", "label_relevance": "High"}, {"_id": "DESKTOP-MNSN261.lumu.lab|36222", "type": "network-endpoint", "label": "36222", "name": "DESKTOP-MNSN261.lumu.lab", "endpoint_ip": "10.0.0.10", "label_name": "Lab_CR", "label_relevance": "High"}, {"_id": "carlos-ubuntu|36222", "type": "network-endpoint", "label": "36222", "name": "carlos-ubuntu", "endpoint_ip": "77.227.136.33", "label_name": "Lab_CR", "label_relevance": "High"}, {"_id": "eliza.net|27713", "type": "network-endpoint", "label": "27713", "name": "eliza.net", "endpoint_ip": "192.168.10.64", "label_name": "epmLow", "label_relevance": "Low"}], "unread": false, "hasPlaybackEvents": false, "autopilotOperation": null, "integrationsThatResponded": ["1d10a312-27ec-4062-9f17-cebd39bc6310", "e01ce476-97e6-4ed6-a414-ddbf27eb9495", "2d5191b6-c267-442e-b829-b5433ba9b956", "601cc508-7b0e-4e4b-b3c8-df8b785c61ed", "12a592e7-97bf-4d89-8cf4-d7a6158d099d", "697ed917-d948-4dc2-bcf1-d9a398f84f64", "fc2d4d83-10d2-43e7-bdcb-c820ca3b3921", "6d76d362-4608-49ee-8d01-e90b93606b66", "b9182337-781c-434d-b2c3-be252340acdc"], "builtInResponseTypes": ["agent"], "accumulators": [{"type": "int_accumulator", "key": "5|13", "value": 1}, {"type": "int_accumulator", "key": "5|12", "value": 4}], "eventsGroupingsCount": 4}, "event": {"eventId": "d73c6680-3a5f-11f1-a3a0-773b17b641c9", "eventType": "malicious-infrastructure", "timestamp": "2026-04-17T13:17:53.256Z", "eventSource": {"source_type": "custom_collector", "source_id": "6b722aac-3d2e-4a15-8e73-f1b271611de6", "collector_index": null}, "adversaryTypes": ["Malware"], "eventDescription": "Malware family Lumma stealer", "affectedEnvironments": [{"type": "network-label", "id": "27713", "label_name": "epmLow", "label_relevance": "Low"}], "targets": [{"_id": "eliza.net|27713", "type": "network-endpoint", "label": "27713", "name": "eliza.net", "endpoint_ip": "192.168.10.64", "label_name": "epmLow", "label_relevance": "Low"}], "offenders": [{"_id": "tactip.cyou", "type": "network-location", "value": "tactip.cyou"}], "fromPlayback": false, "dataToIndex": {"data": {"DNSQueryExtraInfo": {"queryType": "A"}}}, "repetitionCount": 1}}, "url": "https://portal.lumu.io/compromise/incidents/show/.../detections"}

The field values for the previous message are:

PRI: 150
VERSION: 1
TIMESTAMP: 2024-02-16T14:39:49.246Z (ISO 8601 format)
HOSTNAME: 78af70ae0d97
APP-NAME: lumu-incs
PROC-ID: 7
MSGID: ceb204e8272c457d84af3499a15bb011
STRUCTURED-DATA MESSAGE: {"IncidentUpdated": ...}

⁠RFC 3164

The RFC 3164 Syslog standard follows this format:

<PRI>TIMESTAMP HOSTNAME TAG[PID]: MESSAGE

A Lumu RFC 3164 Syslog message looks as follows:

<150>Jun 22 19:50:45 6d2b4d9e1293 lumu-incs[7]: {"IncidentUpdated": {"companyId": "...", "incident": {"id": "...", "timestamp": "2026-04-17T12:11:26.346Z", "status": "open", "statusTimestamp": "2026-04-17T12:11:26.346Z", "incidentGroupingFields": {"adversary": "tactip.cyou"}, "detectorType": "activity", "incidentType": "malicious-infrastructure", "totalEvents": 5, "firstEvent": {"timestamp": "2026-04-17T12:10:52.328Z", "id": "7a937a80-3a56-11f1-a391-773b17b641c9"}, "lastEvent": {"timestamp": "2026-04-17T13:17:53.256Z", "id": "d73c6680-3a5f-11f1-a3a0-773b17b641c9"}, "adversaryTypes": ["Malware"], "description": "Malware family Lumma stealer", "environmentStats": [{"environment": {"id": "36222", "type": "network-label", "label_name": "Lab_CR", "label_relevance": "High"}, "count": 4}, {"environment": {"id": "27713", "type": "network-label", "label_name": "epmLow", "label_relevance": "Low"}, "count": 1}], "counts": {"endpointTargetsCount": 4, "userTargetsCount": 0, "otherTargetsCount": 0, "totalTargetsCount": 4, "offendersCount": 1}, "offendersSamples": [{"_id": "tactip.cyou", "type": "network-location", "value": "tactip.cyou"}], "targetsSamples": [{"_id": "CARLOS-WIN10|36222", "type": "network-endpoint", "label": "36222", "name": "CARLOS-WIN10", "endpoint_ip": "77.227.136.33", "label_name": "Lab_CR", "label_relevance": "High"}, {"_id": "DESKTOP-MNSN261.lumu.lab|36222", "type": "network-endpoint", "label": "36222", "name": "DESKTOP-MNSN261.lumu.lab", "endpoint_ip": "10.0.0.10", "label_name": "Lab_CR", "label_relevance": "High"}, {"_id": "carlos-ubuntu|36222", "type": "network-endpoint", "label": "36222", "name": "carlos-ubuntu", "endpoint_ip": "77.227.136.33", "label_name": "Lab_CR", "label_relevance": "High"}, {"_id": "eliza.net|27713", "type": "network-endpoint", "label": "27713", "name": "eliza.net", "endpoint_ip": "192.168.10.64", "label_name": "epmLow", "label_relevance": "Low"}], "unread": false, "hasPlaybackEvents": false, "autopilotOperation": null, "integrationsThatResponded": ["1d10a312-27ec-4062-9f17-cebd39bc6310", "e01ce476-97e6-4ed6-a414-ddbf27eb9495", "2d5191b6-c267-442e-b829-b5433ba9b956", "601cc508-7b0e-4e4b-b3c8-df8b785c61ed", "12a592e7-97bf-4d89-8cf4-d7a6158d099d", "697ed917-d948-4dc2-bcf1-d9a398f84f64", "fc2d4d83-10d2-43e7-bdcb-c820ca3b3921", "6d76d362-4608-49ee-8d01-e90b93606b66", "b9182337-781c-434d-b2c3-be252340acdc"], "builtInResponseTypes": ["agent"], "accumulators": [{"type": "int_accumulator", "key": "5|13", "value": 1}, {"type": "int_accumulator", "key": "5|12", "value": 4}], "eventsGroupingsCount": 4}, "event": {"eventId": "d73c6680-3a5f-11f1-a3a0-773b17b641c9", "eventType": "malicious-infrastructure", "timestamp": "2026-04-17T13:17:53.256Z", "eventSource": {"source_type": "custom_collector", "source_id": "6b722aac-3d2e-4a15-8e73-f1b271611de6", "collector_index": null}, "adversaryTypes": ["Malware"], "eventDescription": "Malware family Lumma stealer", "affectedEnvironments": [{"type": "network-label", "id": "27713", "label_name": "epmLow", "label_relevance": "Low"}], "targets": [{"_id": "eliza.net|27713", "type": "network-endpoint", "label": "27713", "name": "eliza.net", "endpoint_ip": "192.168.10.64", "label_name": "epmLow", "label_relevance": "Low"}], "offenders": [{"_id": "tactip.cyou", "type": "network-location", "value": "tactip.cyou"}], "fromPlayback": false, "dataToIndex": {"data": {"DNSQueryExtraInfo": {"queryType": "A"}}}, "repetitionCount": 1}}, "url": "https://portal.lumu.io/compromise/incidents/show/.../detections"}

The field values for the previous message are:

PRI: 150
TIMESTAMP: Jun 22 19:50:45 (3-letter month day 24-hour:minutes:seconds UTC)
HOSTNAME: 6d2b4d9e1293
TAG: lumu-incs
PID: 7
MESSAGE: {"IncidentUpdated": ...}

⁠Usage

Prepare the container (replace VALUE with proper values):

docker create \
        -e CUSTOM_OUTPUT="syslog_proto" \
        -e INCLUDE_MUTED_UPDATES=VALUE \
        -e EVENTS=VALUE \
        -e COMPANY_KEY=VALUE \
        -e OUTPUT_SERVERS=VALUE \
        -e SYSLOG_RFC=VALUE \
        --restart unless-stopped \
        --name lumu-universal-siem \
        --log-opt tag=lumu-universal-siem \
        --log-opt max-size=100m \
        --log-opt max-file=1 \
        lumutools/universal-siem:latest

Run it:
```
docker start lumu-universal-siem
```

⁠Parameters

COMPANY_KEY: Lumu integration key.
INCLUDE_MUTED_UPDATES: Set this to true if you want to include contacts of muted incidents, false otherwise (default is false)
EVENTS: Comma-separated list of Lumu events to send. Available values: NewIncidentCreated, IncidentUpdated, IncidentUnmuted, IncidentMuted, IncidentClosed, IncidentIntegrationsResponseUpdated, IncidentBuiltInResponseUpdated, IncidentActionAdded, IncidentMarkedAsRead, IncidentCommentAdded. If this variable is not set, all Lumu events will be sent.

Warning: Do not add spaces between values in EVENTS. Use IncidentUpdated,IncidentMuted (correct), not IncidentUpdated, IncidentMuted (can cause unexpected behavior).
OUTPUT_SERVERS: Syslog server information (PROTO:IP_HOSTNAME:PORT).
SYSLOG_RFC: RFC to use for forwarding events. Select between 3164 or 5424.

⁠HTTP Collector

Use this method if your SIEM supports event collection via HTTP collection. The SIEM exposes an HTTP URL where the forwarder injects data with POST Web requests.

⁠Before you start

First, create the Lumu HTTP collector in your SIEM deployment. If your SIEM requires to send the Web requests with query parameters, a particular body format, or specific headers, create and configure the .env_ auxiliary files as follows:

⁠.env_headers

If you need to set specific HTTP headers, create the .env_headers file using this structure:

APP_HEADERS='
{
    "Content-Type": "application/json",
}'

Within the JSON in the APP_HEADERS variable, define the required headers as a key: value pair.

⁠.env_body

If you need to set a specific HTTP request body format, create the .env_body file using this structure:

# Lumu variable is "{{LUMU_EVENT}}"
APP_BODY='[
{
    "key_1": "value_1",
    ...,
    "key_n": "value_n"
    "message": "{{LUMU_EVENT}}",
}
]'
APP_ESCAPE_LUMU_EVENT=0 # 1|0,  If you need to quote Lumu event as string
APP_REPLACE_LUMU_EVENT=1

Some considerations:

Add the required fields within the HTTP body in key: value pairs. To add the message to the payload, use the string {{LUMU_EVENT}}
The APP_ESCAPE_LUMU_EVENT must be set to 1 if you need to send it as a string. 0 to send it as JSON

If you don't add the {{LUMU_EVENT}} string within the APP_BODY, Lumu events will not be part of the HTTP request's body

⁠.env_queries

If you need to set query parameters for the HTTP request, create the .env_queries file using this structure:

APP_QUERIES='{
    "param1":"value1", 
    "param2": "value2"
}'

Add each required query parameter as a key: value pair.

⁠Usage

Prepare the container (replace VALUE with proper values):

docker create \
        -e CUSTOM_OUTPUT="custom_http" \
        -e COMPANY_KEY=VALUE \
        -e INCLUDE_MUTED_UPDATES=VALUE \
        -e EVENTS=VALUE \
        -e CUSTOM_FULL_URL=VALUE \
        -v $(pwd)/.env_headers:/app/.env_headers \
        -v $(pwd)/.env_body:/app/.env_body \
        -v $(pwd)/.env_queries:/app/.env_queries \
        --restart unless-stopped \
        --name lumu-universal-siem \
        --log-opt tag=lumu-universal-siem \
        --log-opt max-size=100m \
        --log-opt max-file=1 \
        lumutools/universal-siem:latest

If you don't need to define custom parameters for a particular HTTP request attribute, remove the corresponding line from the previous command.

Run it:
```
docker start lumu-universal-siem
```

⁠Parameters

COMPANY_KEY: Lumu integration key.
INCLUDE_MUTED_UPDATES: Set this to true if you want to include contacts of muted incidents, false otherwise (default is false)
EVENTS: Comma-separated list of Lumu events to send. Available values: NewIncidentCreated, IncidentUpdated, IncidentUnmuted, IncidentMuted, IncidentClosed, IncidentIntegrationsResponseUpdated, IncidentBuiltInResponseUpdated, IncidentActionAdded, IncidentMarkedAsRead, IncidentCommentAdded. If this variable is not set, all Lumu events will be sent.

Warning: Do not add spaces between values in EVENTS. Use IncidentUpdated,IncidentMuted (correct), not IncidentUpdated, IncidentMuted (can cause unexpected behavior).
CUSTOM_FULL_URL: Receiver URL given by the SIEM.

⁠General recommendations

For the proper operation of the integration, follow these recommendations:

Integration between Lumu and your SIEM relies on a stable network connection, including the Internet. Make sure the following hosts are reachable:
- SIEM collector/endpoint.
- defender.lumu.io.
- Docker hosts
HTTP, HTTPS, and WSS are required.
When using the Docker image, do not stop the container. Doing this will interrupt the event forwarding process. Events generated with a halted container will not be forwarded to your SIEM.

⁠Find more about us

Lumu⁠

Tag summary

Recent tags

Content type

Image

Digest

sha256:2800cab5a…

Size

60.6 MB

Last updated

3 months ago

docker pull lumutools/universal-siem