• Home
• App Integrations
• SIEM Integrations
• Splunk SIEM Integration

Splunk SIEM Integration Setup

---

Splunk SIEM is a cloud-based security solution that detects threats in real time, analyzes event and incident log data from all security tools. miniOrange provides secure access and full control to Splunk for enterprises and applications. With the help of the given guide you can configure Splunk easily.

1. Enable HTTP Event Collector (HEC)

• Log in to Splunk Web as admin.
• Navigate: Settings >> Data Inputs.



• Select HTTP Event Collector.



• Click on New Token button.



• Configure:
• Name: AuditLogIntegration (Any Name of your choice)
• Source type: _json (Can keep as Automatic)
• Index: e.g., main (Can keep as Default)



• Finish and copy the Token Value.

2. Configure Splunk in miniOrange

• Login on admin dashboard. Select SIEM Management from side menu.



• Click on Configure and select Splunk.



• Provide display-Name,

  API Key(HEC Token copied from step 1)

  and Endpoint URL (https://<SPLUNK_HOST>:8088/services/collector/event)




• Save SIEM configuration.
• Now enable Activate to start sending audit to SPLUNK.





Note:

Superadmin can also activate the SIEM tool for customers using the Manage activation options. Admin can either activate the SIEM tool for all the customers using Activate For all customers option or can activate for individual customers using manage activation option available under the actions menu by clicking on 3 dots.
Please follow this guide to know more.





• Select Activate For All Customers :
• Superadmin can toggle Activate For All Customers to enable the SIEM tool for all tenants in one action.



• Select Manage Activation :
• Superadmin can use Manage Activation to selectively enable the SIEM tool for individual customer accounts.

3. Validate Data in Splunk

• Go to Search & Reporting app.
• Run query: index=main source="AuditLogIntegration" (HTTP Event Collector Name)
• Confirm logs appear as expected.