...
The guide below will walk you through how to start receiving Data Theorem events in Splunk.
The following Data Theorem events are sent via the webhook integration:
...
When an API Secure policy violation was opened.
...
Once you have configured your integration, you can find the find the Webhook Schema here
Configuring Splunk to receive events from Data Theorem
...
Step 2: Create an new index for HEC events from DT
Click Settings > Indexes
Click New Index
Configure Your Index
...
Index name: Whatever you want. This example uses “dtevents”
...
Step 3: Create an HEC Token
Click Settings > Data Inputs
Click HTTP Event Collector > Actions > +Add New
Add New HEC Token Page 1 of 4
...
| Code Block |
|---|
{"text":"Success","code":0} |
Step 5:
...
Email to support@datatheorem.com the following information:
Splunk HEC URL
Splunk HEC Token Value
Name Of Integration (may contain letters, numbers, dashes, underscores, and spaces)
...
Configure Your Splunk Integration
Navigate to Create New Integration Page on Data Theorem’s Portal
Name your Splunk Integration
...
3. Enter Splunk HEC Details
...
4. Select Events To Send To Splunk
...
Viewing Data Theorem Events In Splunk
...
Example Event Detail View
...
...
Example Splunk Queries
Public S3 Buckets
To search Splunk for Data Theorem events triggered by the discovery of public S3 buckets:
...
| Code Block |
|---|
event.data.violated_policy_rule_type_name=AWS_S3* |
References
Data Theorem Event Message Schema
Data Theorem Splunk Dashboard Example
...