Splunk XDR integration

Procedure

1. On the Trend Vision One console, obtain the Endpoint URL and the Authentication token.
   1. Go to Workflow and Automation → Third-Party Integration.
   2. Select Splunk XDR.
   3. Use the copy icons () to obtain the following information:
      • Endpoint URL
      • Authentication token
   4. (Optional) If the authentication token is expired or does not exist, click Generate and enter the required information in the API Key Settings window to add a new token.
2. Search for and install the Trend Vision One for Splunk (XDR) app from Splunkbase.
3. Once the app is installed, go to Apps → Trend Vision One for Splunk (XDR) on the Spunk console.

   

4. Configure the account settings.
   1. Go to Configuration → Accounts.
   2. Use the edit icon () next to each account to modify its settings.
   3. Paste the Endpoint URL and Authentication token obtained from the Trend Vision One console. If you have multiple authentication tokens, separate them with semicolons.
   4. Click Update.
   5. (Optional) Go to Configuration → Proxy and enter the following information as necessary:
      • HTTPS Proxy Address
      • Retry Interval
   6. Click Save.
5. (Optional) Add a new account.
   1. Click Add.
   2. Enter the Account name and paste the Endpoint URL and Authentication token from the Trend Vision One console.
   3. Click Add.
6. Configure the data inputs used by Splunk.
   1. Go to Inputs in the menu bar.
   2. Under Status, use the toggle to enable or disable each data input.
   3. Use the edit icon () to configure settings for the data input.
   4. Enter the following information for the data input:
      • Name
      • Interval
      • Index
      • Global account
   5. Click Update.
7. (Optional) Add a new data input.
   1. Click Create New Input.
   2. Select a data input from the following:
      • Trend Vision One Workbench Alerts
      • Trend Vision One Observed Attack Techniques
      • Trend Vision One Audit Logs
      • Trend Vision One Detection
   3. Enter the Name, Interval, and Index, and select the Global account for the data input.

      Note The Observed Attack Techniques data input type additionally requires you to select a Risk level, and synchronizes all events with a risk level equal to or higher than the level specified. Selecting undefined, info, or low might cause a high volume of data transfer.

   4. Click Add.
   After successfully installing the Splunk app, Splunk begins collecting XDR data from Trend Vision One. Splunk can only collect XDR data generated after connecting to Trend Vision One. You might need to allow some time before new XDR data starts to appear.