Articles in this section

See more

Splunk

You can configure Lacework to forward alerts to Splunk using an HTTP Event Collector.

Lacework forwards events to Splunk using a destination port of either 80 or 443. If Splunk is configured to use another port, for example, 8088, you must set up port forwarding.

Create a Splunk HTTP Event Collector

  1. Navigate to Settings > Data Inputs.
  2. In the HTTP Event Collector row, click + Add new.
  3. On the Select Source page:
    1. Provide a name for your token.
    2. Optionally, override the default source name and provide a description. For example, "lacework_events" and "HEC for Lacework Events"
    3. Optionally specify an Output Group.
    4. At the top of the page, click Next.
  4. On the Input Settings page:
    1. Specify a Source type or leave as automatic. Lacework sends the data as json, so you can explicitly choose _json under Structured.
    2. Choose an App Context as applicable to your Splunk design and use.
    3. Choose Indexes as applicable to your Splunk design and use.
    4. At the top of the page, click Review.
  5. On the Review page, review your inputs, and click Submit at the top of the page.

You should see the message Token has been created successfully. You will need the token, index, source and resolvable hostname or IP address of your Splunk instance.

Add a Lacework Integration

After you create your Splunk HTTP event collector, return to the Lacework Console and complete the following steps:

  1. Log in to the Lacework Console with a Lacework user that has administrative privileges.
  2. Select Settings > Integrations.
  3. Under OUTGOING, select Splunk.
  4. Click + Add Integration.
  5. Name the integration.
  6. Enter your Splunk HEC token.
  7. Optionally enter a Splunk channel.
  8. Enter the resolvable hostname or IP address of your Splunk instance.
  9. Enter the destination port for forwarding events [80 or 443].
  10. Check the SSL box if appropriate.
  11. Enter your Splunk index.
  12. Enter your Splunk source.
  13. Select an alert severity level; Lacework forwards events that only meet or exceed the chosen threshold.
  14. Click Save.

To test your Integration, click Test Integration. You should see a positive affirmation of the test and a single event sent to Splunk with the field-value pair of 'host :login.lacework.net'. You should start to receive Lacework event notifications in Splunk.