Forwarding Events to Splunk

Requirements

1. Access to the Keep Aware Console: Ensure you have valid login credentials and are logged in to the console.
2. Permissions to configure HTTP Event Collectors to your Splunk Workspace: Confirm that you have the necessary permissions to add new HTTP Event Collectors in your Splunk environment.

Setup a Splunk HTTP Event Collector URL

First you will need to setup a Splunk HTTP Event Collector URL or you can use one you have already created.

For information regarding setting up Splunk HTTP Event Collector URL refer to their documentation below.

Configure HTTP Event Collector in Splunk

Setting up Splunk in Keep Aware

To get started, navigate to the Integrations Page and select the Splunk integration. This will open a modal where you can select Create New Integration and begin configuring the integration.

Image: Integrations Page

View in console

Here we will configure each of the fields below:

• Identifier: A unique name for your Splunk Integration.
• Splunk HTTP Event Collector: Your Splunk HTTP Event Collector URL.
• HTTP Event Collector token: Your Splunk HTTP Event Collector token.
• Body: This is the JSON body that will be sent to Splunk. See below for information on customizing the event body.

After you save the integration, that will complete the basic setup for getting Splunk connected to Keep Aware.

Continue below for how to customize the body that is sent to Splunk.

Frequently Asked Questions

Question	Answer
How can I find out what message formatting options are available in Splunk?	Splunk will accept any data format to its raw endpoint as long as it is JSON compliant, the event endpoint however has tighter criteria. For more information visit the Formatting events for HTTP Event Collector documentation.
How can I find out what Event and Threat fields can be forwarded to Splunk?	All available Threat and Even fields are described and documented in the Event and Threat Fields Documentation.