Splunk Integration (Audit Log Export)

Stream your account's audit log (the history of Console / API operations) to your Splunk Cloud via HEC (HTTP Event Collector), with reliable delivery backed by indexer acknowledgement.

• Plan: Business and above
• Status: Experimental (feedback welcome)
• Format: JSON conforming to OCSF (Open Cybersecurity Schema Framework) v1.1.0

1. Setup

On the Splunk side (5 min)

1. In Splunk Cloud, create a new HEC token under Settings → Data Inputs → HTTP Event Collector
2. When creating the token, turn on "Enable indexer acknowledgement" (recommended — AgenTrux marks a batch as delivered only after the indexer confirms it, preventing data loss)
3. Note your HEC URL. Splunk Cloud is usually https://http-inputs-<stack>.splunkcloud.com (port 443). Self-managed deployments may use 8088

On the AgenTrux side (2 min)

1. Sign in to the Console → Account → Integrations (Experimental) → Splunk Audit Export
2. Fill in:

   Field	Value
   HEC URL	https://<host> (port 443 or 8088; no path needed)
   HEC Token	The token created above
   Index	Target index (optional; token's default index if omitted)
   Source / Sourcetype	Defaults agentrux:audit / _json are fine
   Indexer acknowledgement	Keep enabled (recommended)

3. Save configuration → Test connection (sends one real test event and waits for the ack)
4. Enable export — streaming starts here

2. What flows, and how

• Scope: audit events attributed to this account (sign-ins, Topic/Script/Grant creation and changes, settings changes, authentication and credential operations, and so on). Event payloads exchanged by your agents are not included
• Delivery takes a few minutes (periodic transfer with a grace window to avoid losing late-arriving records)
• On first enable, the available audit history of the account is exported from the beginning
• Delivery is at-least-once. Indexer ack prevents loss, but retries can duplicate an event; for strict counting, dedupe on event.metadata.uid (unique per event)
• If the plan drops below Business, the integration disables itself automatically (this is also recorded and exported as the audit event splunk_export.auto_disable). After upgrading, re-enable it in the Console — export resumes from where it stopped, with no gaps

3. Event structure

Events arrive in the standard HEC envelope. time is when the audit event occurred; the OCSF body is under event:

Main fields under event.*:

4. SPL recipes

# All audit events (fields auto-extracted thanks to sourcetype=_json)
source="agentrux:audit"

# Dedupe and count (drop at-least-once resends)
source="agentrux:audit" | dedup event.metadata.uid | stats count

# All failed operations
source="agentrux:audit" event.status=Failure

# Authentication / credential operations
source="agentrux:audit" event.class_uid=3002

# Activity of a specific user / agent
source="agentrux:audit" event.actor.user.uid=usr_xxxx

# Count by operation
source="agentrux:audit" | dedup event.metadata.uid
  | stats count by event.activity_name | sort -count

# Grant (access right) changes
source="agentrux:audit" event.activity_name=grant.*

# State changes of the integration itself (detect auto-disable)
source="agentrux:audit" event.activity_name=*_export.auto_disable

5. Suggested alerts (saved searches)

• Spike in event.status=Failure (anomalous failure volume)
• Repeated event.class_uid=3002 event.status=Failure (authentication failure attempts)
• event.activity_name IN (*credential*, *revoke*, grant.*) (notify on permission / credential changes)
• event.activity_name=*_export.auto_disable (know when the export stopped)

6. Operational notes

• HEC token rotation: issue a new token in Splunk, then re-enter and save it in the Console — export uses the new token from the next cycle
• The integration's state (last successful export, consecutive failures, last error) is shown on the Console's Splunk page
• If the connection test reports "HEC accepted but ack not confirmed", check the token's indexer-acknowledgement setting
• Want the same audit log in Datadog? See the Datadog Integration — both can run at the same time