Integrate Prisma Cloud with Splunk

Set up Splunk HTTP Event Collector (HEC) to view alert notifications from Prisma Cloud in Splunk.
Splunk HEC lets you send data and application events to a Splunk deployment over the HTTP and Secure HTTP (HTTPS) protocols. This helps consolidate alert notifications from Prisma Cloud in to Splunk so that your operations team can review and take action on the alerts.
To set up HEC, use instructions in Splunk documentation.
For
source type
,
_json
is the default; if you specify a custom string on Prisma Cloud, that value will overwrite anything you set here.
Select
Settings
Data inputs
HTTP Event Collector
and make sure you see HEC added in the list and that the status shows that it is
Enabled
.
Set up the Splunk integration in Prisma Cloud.
Log in to Prisma Cloud.
Select
Settings
Integrations
.
Create a
+New Integration
.
Set
Splunk
 as the
Integration Type
.
Enter an
Integration Name
, optionally, a
Description
.
Enter the
Splunk HEC URL
that you set up earlier.
The Splunk HEC URL is a Splunk endpoint for sending event notifications to your Splunk deployment. You can either use HTTP or HTTPS for this purpose. Since Prisma Cloud sends data about an alert or error in JSON format, make sure to include
/services/collector
endpoint as part of the Splunk HEC URL.
Enter
Auth Token
.
The integration uses token-based authentication between Prisma Cloud and Splunk to authenticate connections to Splunk HEC. A token is a 32-bit number that is presented in Splunk.

(
Optional
) Specify the
Source Type
if you want all Prisma Cloud alerts to include this custom name in the alert payload.
Click
Test
and then
Save
your changes.
The integration status check for Splunk displays as red if the event collector URL is not reachable or times out or if the authentication token is invalid or receives an HTTP 403 response.
Create an Alert Rule for Run-Time Checks or modify an existing rule to receive alerts in Splunk. (See Send Prisma Cloud Alert Notifications to Third-Party Tools.)