Skip to main content

Sending SlashID Detections to Splunk

SlashID can forward real-time identity security detections directly to your Splunk Cloud environment using HTTP Event Collector (HEC). This guide walks you through the steps to configure Splunk and connect it with SlashID.

info

HEC does not work with Splunk trial accounts using port :8088, due to issues with self-signed certificates.

Step 1: Create an HTTP Event Collector Token in Splunk Cloud​

  1. Log in to your Splunk Cloud Platform instance.
  2. Navigate to Settings > Add Data.
  3. Click Monitor.
  4. Choose HTTP Event Collector.
  5. Click New Token.

Configure the token:​

  • Name: Enter a descriptive name, e.g., SlashID Detections.
  • Source name override: Use something like slashid-detections to help identify incoming data.
  • [Optional] Description: Add a short note for future reference.
caution

Do not enable indexer acknowledgment.

  1. Click Next.
  2. [Optional] Adjust the source type or select the desired index where events should be stored.
  3. Click Review, and then Submit to create the token.
info

It may take a few moments for the token to become active across your Splunk deployment.

Step 2: Collect Your Splunk Endpoint URL and Token​

Once the token is created, note down the following:

  • Splunk HEC URL: Format: https://{your-splunk-id}.splunkcloud.com/services/collector/event

  • Token: This will be shown after token creation.

Step 3: Configure SlashID to Send Detections​

  1. In the SlashID Console, go to Identity Protection > Configuration > Connectors.
  2. Choose Add Connector and select Splunk from the list.
  3. Paste the Splunk HEC URL and token into the appropriate fields.
  4. Choose which types of detections or environments you want to sync.
  5. Save and activate the connector.

Once configured, SlashID will stream detection events (e.g., privilege escalation, credential misuse, lateral movement) to your Splunk instance in real time.

Need Help?​

If you run into issues during setup or if your Splunk instance requires custom configuration (e.g., proxy, custom source types), reach out to support@slashid.dev.