Splunk HEC connector configuration

Procedure

1. Go to Workflow and Automation → Third-Party Integration.
2. Click Splunk HEC Connector (SaaS/Cloud).
3. Click + Connect Splunk HEC Server.
   The Splunk HEC Server Connection window appears.
4. Configure the connection settings in the Splunk HEC Server Connection panel.

   Setting	Description
   Firewall exceptions	To make sure that Trend Vision One can communicate with your Splunk HEC server, add any FQDN/IP addresses displayed in the Splunk HEC Server Connection window to your firewall exceptions.
   Server address	Specify the IP address or FQDN for your Splunk HEC server.
   Format	Specify a format for the transferred data. Note Splunk HEC Connector (SaaS/Cloud) only supports JSON format.
   Protocol	Select a connection protocol from the list.
   Port	Select a port for the connection. Default port settings: HTTP: 8088 HTTPS: 8088
   HEC token	Specify the Splunk HTTP Event Collector token.
   Use CA certificate	To use a CA certificate to connect to your Splunk HEC server, you can select Use CA certificate.
   Server requires client authentication	To require a client authentication certificate, you can select Server requires client authentication.

5. Configure the scope of data to send to Splunk Cloud by selecting from the following:
   • Workbench alerts
   • Events
     • Observed Attack Techniques (requires specifying event severity)
     • All detections
   • Container vulnerabilities
   • Activity data (requires specifying scope)

     Note Sending activity data requires Trend Vision One credits. Configure the data allowance for transferring activity data and manage credit allocation in the Credits & Billing app.

6. Click Test Connection to verify if the settings are valid.
7. Click Connect.
   The Splunk HEC server appears on the Splunk HEC Connector (SaaS/Cloud) screen.
8. You can repeat the previous steps to add multiple Splunk HEC servers with their own data source configurations.
9. You can use the or icons to modify or delete a server from the Splunk HEC Connector (SaaS/Cloud) screen.