...
Once you have configured your integration, you can find the find the Webhook Schema here
Configuring Splunk to receive events from Data Theorem
...
Step 2: Create an new index for HEC events from DT
Click Settings > Indexes
Click New Index
Configure Your Index
...
Index name: Whatever you want. This example uses “dtevents”
...
Step 3: Create an HEC Token
Click Settings > Data Inputs
Click HTTP Event Collector > Actions > +Add New
Add New HEC Token Page 1 of 4
...
| Code Block |
|---|
{"text":"Success","code":0} |
Step 5:
...
Email to support@datatheorem.com the following information:
Splunk HEC URL
Splunk HEC Token Value
Name Of Integration (may contain letters, numbers, dashes, underscores, and spaces)
...
Configure Your Splunk Integration
Navigate to Create New Integration Page on Data Theorem’s Portal
Name your Splunk Integration
...
3. Enter Splunk HEC Details
...
4. Select Events To Send To Splunk
...
Viewing Data Theorem Events In Splunk
...
| Code Block |
|---|
event.data.violated_policy_rule_type_name=AWS_S3* |
References
Data Theorem Event Message Schema
Data Theorem Splunk Dashboard Example
...