Overview

Event Replay provides a capability to reflect historic events data to required destination on an on-demand basis. This essentially requires Snare Central to fetch a set of archived events based on specified search query and forward to configured destination when requested.

Default Settings

Snare Replay feature is disabled by default. You can enable this feature from the Reflector > Settings > General page by selecting the Enable Event Replay option.

To support replay functionality, Snare Central must retain events in their original, unprocessed format as they were received, in it’s store. This can be configured using the Enable Original Event option, available on the Reflector > Settings > General page. Enable Original Event is enabled on Snare Central new installation, whereas disabled on full upgrade, by default.

Open

Configure Replay

In Snare Central, replay targets are managed through tasks. Each task specifies specific destination, where the replayed events should be sent, along with the query and filter settings that determine which events are included in the replay.

Navigate to Reflector UI and open Configure Replay page. This page lists all the replay tasks, that are configured.

Open

View Replay Task List

Replay Tasks tab in Reflector > Configure Replay page contains two panels:

• Left Panel - List of all the configured tasks and their status indicators.

• Right panel - Details of the task selected from the list on the left.

The Task List displays each task with its user-defined name, along with the status indicator of the most recent replay triggered for that task.

Add Replay Task

Select + Add Replay Task tab on the Reflector > Configure Replay page to add a new replay task.
The following form will be displayed:

Open

Select ADD to add the task, after all parameters are configured as explained below.

Task Details

Open

Task Details defines the following details:

• Task Name - User-friendly name of the task, used for display purposes.
  The name can contain alphanumeric characters (a-z, A-Z, 0-9), special characters (~!@$%^()_+=-#) and spaces are allowed.

• Retry Count - Defines the number of retry attempts before the connection to the destination is closed if Replay fails to send an event.

• Event Fetch Limit Per Request - Defines how many events are loaded at a time from events stored in Snare Central, during the replay process, helping manage memory and performance.

• Events Per Second Limit - Controls the rate at which events are forwarded to the destination, helping to prevent the destination from being overwhelmed by events sent faster than it can process.

Query

Open

Query defines the set of events to be replayed, based on the folowing selectors. 

Query Selectors

Date and Time Open	Replay events within a given date and time range. Date and Time search criteria can be defined using either Quick Picks or using a custom Date and Time.
Systems Open	Set of events to be replayed, can be narrowed by selecting systems that generated the events. By default, all systems will be included in the query. Click the selector and use check boxes to choose systems of interest. Use the filter to quickly find a system by host name or IP address.
Log Types Open	Set of events to be replayed, can be narrowed by selecting Log Types. By default, all log types will be included. Click the selector and use check boxes to choose from available log types. Use the filter to quickly find a log type to be included in the query.
More Fields Open	Replay events containing text that appears in specific event fields, by clicking the More Fields selector.  A filter can be used to quickly find a field of interest. Click >> to reveal an input field, and enter your search criteria in the field. Multiple values are supported.

Destination Details

Destination specifies the target location to which events will be forwarded during a replay request. A destination can be a newly configured destination or one of destinations configured in Reflector.

Click the selector “Select Option” and select destination type of interest.

Open

New Destination

Select “New Destination“ from the “Select Option” selector to configure a target destination for the replay task.

• IP/Hostname - An IP address or a hostname to which the Snare Replay should send the events.

• Port - The target port on the destination server to send events to.

• Destination Format - Events will be converted to the selected format before being sent to this destination.

  • Snare Server 7.1+ - Events will be sent using a Snare Central internal format.

  • Syslog RFC 5424 - Events will be sent using the latest generation of the syslog protocol, with fields parsed from the source log included within the RFC5424 structuredData element.

  • Syslog RFC 3164 - Events will be sent using the older generation of the syslog protocol. Note that some information (such as the 'year' in which the log was generated) will be lost, when using this format.

  • QRadar - Syslog RFC 3164 format, but the SnareReplay will attempt to remove the first tab-delimited field supplied with the original event, as long as it does not include internal spaces, in order to work around a QRadar processing issue.

  • RSA Envision - Syslog RFC 3164 format, but the SnareReplay will prefix a header to the syslog message, which includes the originating IP address, and the date/time in seconds-since-epoch format that the event arrived at the server.

  • RAW - no conversion - No format conversion will be performed.

  • Generic JSON - Both header and event content information is represented in a single-line JSON format.

  • Syslog 5424 JSON - Syslog RFC 5424 header, with JSON payload. In the event that a Snare V2 format log is received, it will be send in the original format, with any extra enhancements inserted as key/value pairs into the Event/Data/SnareDataMap key.

  • Syslog RFC5424 - no structuredData - Events will be sent using the latest generation of the syslog protocol, but will explicitly avoid injecting field data into the structuredData component of RFC5424, if the original event does not already include structuredData.

  • CEF - The event will be converted to CEF format, where each event field, will be either implemented as a vendor CEF field in the CEF Extension area, or will be mapped to baseline CEF fields. As at the date of this document, the events from Snare for Windows agents will include the advanced CEF field mapping.

  • CEF Syslog RFC3164 - CEF format as discussed above, with a Syslog RFC3164 header.

  • Splunk HEC - Format for delivery to Splunk HTTP Event Collector (HEC) over HTTP/HTTPS protocol.

    Selecting Splunk HEC format will display additional fields for configuring HTTP/HTTPS connection to Splunk HEC.
    For details, please Refer to Sending Logs to Splunk HEC page in this User Guide.

  • Snare Legacy Realtime Delivery - Snare internal legacy format.

  • Snare v8 Data Exchange (JSON) - Snare internal format and also for use from Snare Central to Snare Central forwarding. NOTE: this can only be used to other 8.4.0+ destinations.

  • Securonix Syslog - Syslog RFC 3164 format, but the SnareReplay will attempt to remove the first tab-delimited field if it is a duplication of hostname in the event header.

• Protocol - Select one of the following network protocols for data delivery. Note: available options may change based on the selected Destination Format

  • TCP

  • UDP

  • HTTP - HTTP delivery to REST APIs provided by the receiver (available with relevant Destination Formats, such as Splunk HEC).

  • HTTPS - HTTPS delivery to REST APIs provided by the receiver (available with relevant Destination Formats, such as Splunk HEC).

• Fields Remapping - When sending data to HTTP-based destination format like Splunk HEC, an additional layer of transformation is available through Fields Remapping. This feature allows Snare log fields to be further refined and mapped to the specific schema expected by the target platform, ensuring compatibility and usability within the receiving system. Fields Remapping is defined by the following parameters.

  • Remapping Template: Select one of the pre-configured Remapping Templates from the selector.

  • Maximum Size Per Request : Set a limit on maximum size per request in KB.

Open

Already Configured Destination

Already Configured Destination allows you to select a target destination from the list of destinations previously configured in Reflector.

Select “Already Configured Destination“ from the “Select Option” selector.

Open

Use Select Destination dropdown to choose one of the available destinations from the list.

Once selected, all related fields—including Filters, Search and Replace, and others—will be automatically populated with the corresponding configuration data.

Filters

Open

Users can define filters to further narrow down the events to be replayed to the destination. These filters are applied on top of the events fetched from Snare Central store based on the configured Query, ensuring that only matching events are replayed.

By default, no filters are applied, and all the events stored in Snare Central that match the configured Query are replayed to the destination.

Search Replace

Open

Snare Replay destination can be configured to modify events before sending to the destination.

You can either do the search and replace in the event data based on the incoming format (before converting it to the destination format), or based on the outgoing format (after converting it to the destination format), by simply setting the toggle button to "Apply Search-Replace filters to events in INCOMING format" or "Apply Search-Replace filters to events in OUTGOING format".

View Replay Task Details

Select Replay Tasks tab on the Reflector > Configure Replay page to view a replay task configurations.
In the left panel select the task you are interested in. The task details will be presented in the right panel.
The header of the right panel contain the following information: Replay Task Name | Task Status

Open

For detailed description of all the task parameters, see Add Replay Task section above

Modify Replay Task

Select Replay Tasks tab on the Reflector > Configure Replay page to modify a configured replay task.
In the left panel, select the task that needs to be modified.

Edit any fields of the task, add/remove filters and search-replace rules as required. 
For detailed description of all the task parameters, see Add Replay Task section above.

Select APPLY SETTINGS to save the settings.

Open

Delete Replay Task

Select Replay Tasks tab on the Reflector > Configure Replay page to delete a configured replay task.

In the left panel, select the task that needs to be modified.

Open

Confirmation screen will be displayed.

Open

Select CONFIRM to delete the task.
or
Select CANCEL to cancel the deletion operation.

Start Replay

Start Replay initiates the replay of events based on the task's configuration. It retrieves events stored in Snare Central that match the specified Query and Filters, and then forwards them to the task's configured destination.

Select Replay Tasks tab on the Reflector > Configure Replay page.

In the left panel, select the task that needs to Start replay.

Select Start option from the Action () button in the header of the task details. 

Open

Troubleshooting

Failure Analysis

All failure log and relevant information are recorded in the system log under the SnareReplay.log file. If any of Snare Replay operations or actions such as View Replay Task List, Add Replay Task, View Replay Task Details, Modify Replay Task, Delete Replay Task, Start Replay fails, follow the steps below to troubleshoot.

• Access the Log File via the Snare User Interface:

  • Navigate to the "System > Administrative Tools > Display the Snare Central Log Files" page in Snare User Interface.

  • Locate and select the SnareReplay.log file from the list of log files.

• Review the Log Details:
  Examine the log entries to identify the cause of the failure and take appropriate corrective actions based on the error messages or warnings listed.

Audit Event

Whenever a configuration change or user action related to Snare Replay is performed, an audit event of type SnareServerLog is automatically generated.
To view these audit events:

• Go to the "Events Search" page in the Snare User Interface.

• Search for events of type SnareServerLog under “Log Type” selector, to review Snare Replay activity and changes.

Operational Considerations

• Single Replay per Task:
  Only one Replay Start operation can run at a time for a specific task. If a replay is already in progress for a task, the Start action is disabled until the replay either completes or fails.

• Task Lock During Replay:
  A task cannot be deleted or modified while its replay operation is in progress. You must wait for the current replay to finish or fail before making any changes.

• Concurrent Replays Limit:
  A maximum of 10 tasks can be in a replay InProgress state at the same time across the system.

• Interrupted Replays:
  If a replay InProgress task is interrupted due to system events, such as Snare Central Reboot or Snare Service Restart, the replay will automatically resume from the point of failure once the Snare Replay service is restored.