Data Theorem now supports integration with a customer's Splunk SIEM infrastructure. Data Theorem's API, Web and Cloud Secure products can send events to Splunk using Splunk's HTTP Event Collector (HEC). For more information on Splunk's HEC, see Splunk's documentation here.
The guide below will walk you through how to start receiving Data Theorem events in Splunk.
Configuring Splunk ES to receive events from Data Theorem
Step 1: Enabling HTTP Event Collector (HEC)
HEC must be enabled in your Splunk deployment to receive events from Data Theorem. Splunk functionality varies based on Splunk software type, so please follow the directions below for your Splunk deployment:
- Configure HTTP Event Collector on Splunk Enterprise
- Configure HTTP Event Collector on self-service Splunk Cloud
- Configure HTTP Event Collector on managed Splunk Cloud
Step 2: Create an new index for HEC events from DT
Click Settings > Indexes
Click New Index
Configure Your Index
Index name: Whatever you want. This example uses “dtevents”
Index Data Type: Events
Max raw data size: Use a value that makes sense for your deployment. This example uses 0
Searchable time: Use a value that makes sense for your deployment. This example uses 7
Step 3: Create an HEC Token
Click Settings > Data Inputs
Click HTTP Event Collector > Actions > +Add New
Add New HEC Token Page 1 of 4
Name: Whatever you want
Source name override: Blank
Enable indexer acknowledgment: Must be unchecked
Add New HEC Token Page 2 of 4
Source type: Automatic
App context: Search and Reporting
Select Allowed Indexes: Select the index you created earlier. This example uses “dtevents”
Add New HEC Token Page 3 of 4
Confirm your settings and click Submit
Add New HEC Token Page 4 of 4
Please contact Data Theorem support with your Splunk HEC Token Value to complete the integration.
Step 4: Validate Splunk configuration by sending a test event
Determine Your Splunk HEC URL
Send A Test Event
curl -k "https://<your splunk server HEC URL>" \
-H "Authorization: Splunk <your splunk token from previous step>" \
-d '{"event": "Hello, world!", "sourcetype": "manual"}'
If the command above succeeded, and Splunk is configured correctly, the output from executing the command above should be:
{"text":"Success","code":0}
Step 5: Send Splunk information to Data Theorem
Email to support@datatheorem.com the following information:
Splunk HEC URL
Splunk HEC Token Value
Name Of Integration (may contain letters, numbers, dashes, underscores, and spaces)
Data Theorem will then enable the integration, and will start sending events to your Splunk instance.
Viewing Data Theorem Events In Splunk
To view Data Theorem events in Splunk perform a search query with index=”dtevents”
Example Search Results
Example Event Detail View
