Send Tripwires Alerts to Splunk Cloud¶
Send NodeZero Tripwires alerts to Splunk Cloud through its HTTP Event Collector (HEC). Create an HEC token in Splunk Cloud, then connect a Tripwires Webhook instance in NodeZero that uses it.
Create an HEC Token in Splunk Cloud¶
Enable HEC and create a token for NodeZero to send events with.
- In Splunk Web, go to Settings > Data Inputs > HTTP Event Collector.
- Select Global Settings and set All Tokens to Enabled.
- Select New Token and configure the token, including its name, source type, and index.
- Select Next, then Review, then Submit.
- Copy the token value.
For details, see Splunk's HTTP Event Collector documentation.
Connect Splunk Cloud in NodeZero¶
Follow Connect the Instance and Create the Route, using these values:
| Field | Value |
|---|---|
| Instance label | A name for this Splunk Cloud destination, such as SOC – Splunk Cloud |
| Instance URL | Your Splunk Cloud HEC endpoint URL |
| Header Name | Authorization |
| Header Value | Splunk <token>, where <token> is the HEC token you copied |
| Data set (route) | Tripwires |
Then test the integration and search your HEC index in Splunk for the test event.