Splunk
Usage
By connecting Splunk's robust data analysis capabilities with Netography's network insights, organizations gain real-time alerting, monitoring, and comprehensive views of their security landscape. This integration also streamlines workflows, aids in compliance reporting, and offers scalable solutions that adapt to evolving needs, thus providing a valuable tool for improving decision-making, security response, and overall efficiency.
Prerequisites
Before configuring the Splunk integration in Netography, you will need to create a new Token for the HTTP Event Collector. For more information, consult the HTTP Event Collector documentation for Splunk.
Netography Portal Steps
In Settings > Response Integrations, click Add Integration. Select Splunk
Configuration
The following fields are specific to the Splunk integration.
The webhook URL should point to the 'services/collector/raw' endpoint of the HTTP Event Collector, as described in [Splunk's Documentation] (https://docs.splunk.com/Documentation/Splunk/latest/Data/UsetheHTTPEventCollector#Send_data_to_HTTP_Event_Collector).
Ensure that the HTTP Event Collector port can be reached from Netography's "integrations" IP address, which can be obtained from the Settings Overview page in the Netography Fusion portal.
| Field | Required | Description | Example |
|---|---|---|---|
URL | yes | The webhook URL from Splunk | https://splunkhec.example.com:8088/services/collector/raw |
Skip SSL Verification | no | If checked, the server certificate will not be validated against the available certificate authorities. | |
Headers | no | Comma separated list of header: value pairs | X-Netography: Webhook |
Authentication
The following fields are necessary for the integration to authenticate using HTTP Basic Auth.
| Field | Required | Description |
|---|---|---|
Username | no | Name of the HTTP Event Collector Token |
Password | no | Token Value |
After your configuration is submitted, the Splunk integration will be treated as a standard webhook integration in the Fusion portal.
Additional post configuration
After the Splunk configuration is setup, you will need to configure a Response Policy in the Fusion portal.
Configure a Response Policy to Sent Events to Splunk
You can configure response policies in the portal by navigating to Response -> Response Policies -> Add Response Policy.
Updated about 1 month ago