{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":[]},"type":"markdown"},"seo":{"title":"Splunk SIEM Integration","description":"Control the power of AI Agents in runtime.","llmstxt":{"hide":false,"sections":[{"title":"Table of contents","includeFiles":["**/*"],"excludeFiles":[]}],"excludeFiles":[]}},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"splunk-siem-integration","__idx":0},"children":["Splunk SIEM Integration"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Push Capsule detections, findings, and policy violations straight into Splunk over HTTP Event Collector (HEC), already sourcetyped, so your SOC triages AI-agent and shadow-AI signals next to the rest of its telemetry."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"overview","__idx":1},"children":["Overview"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Capsule sends each event to your HEC endpoint as it is produced. There is no bucket to poll, no SQS plumbing, and no AWS add-on."]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Event type"},"children":["Event type"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"What gets exported"},"children":["What gets exported"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Detections"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Real-time detections raised on agent activity, with full event context"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Findings"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Posture and configuration findings across your AI inventory"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Policy violations"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Guardrail and policy breaches, with the full evidence the decision was made on"]}]}]}]}]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"header":{"controls":{"copy":{}}},"source":"Capsule event (detection / finding / policy violation)\n  → POST to your HEC endpoint, gzipped, as capsule:<type>\n  → searchable in your index\n  → (optional) the Capsule Technology Add-on maps it to CIM\n  → Enterprise Security sees it through the Alerts and Intrusion Detection data models\n"},"children":[]},{"$$mdtype":"Tag","name":"blockquote","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This is separate from ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Settings → Notifications"]},". Notifications push individual alerts to a channel; the SIEM integration streams the full, verbose event record for ingestion and long-term correlation."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["You can also reach Splunk through Capsule's Amazon S3 destination, but only via the Splunk Add-on for AWS and the SQS notification plumbing it expects. HEC is the supported path."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"prerequisites","__idx":2},"children":["Prerequisites"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["A ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Capsule"]}," account with admin access, and the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["SIEM"]}," tab visible under ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Settings"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Splunk Cloud"]}," or ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Splunk Enterprise"]}," with HTTP Event Collector enabled. On Splunk Cloud, HEC is on by default"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Permission in Splunk to create a HEC token, and to install an add-on if you want CIM normalisation"]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-1-create-a-hec-token-in-splunk","__idx":3},"children":["Step 1: Create a HEC token in Splunk"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["In Splunk, go to ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Settings → Add Data"]},", choose ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Monitor"]},", and pick ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["HTTP Event Collector"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Give the token a ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Name"]},", for example ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["capsule"]},", and click ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Next"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["On ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Input Settings"]},", leave ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Source type"]}," as ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Automatic"]}," - Capsule sets the sourcetype on every event."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Still on ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Input Settings"]},", choose the index Capsule should write to and make sure that index is in ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Select Allowed Indexes"]},". An event naming an index outside that list is rejected with ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["HTTP 400, code 7"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Click ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Review"]},", then ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Submit"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Copy the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["token value"]}," Splunk shows, and note your HEC endpoint:",{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Splunk Cloud: ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["https://http-inputs-<your-stack>.splunkcloud.com"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Splunk Enterprise: ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["https://<splunk-host>:8088"]}]}]}]}]},{"$$mdtype":"Tag","name":"blockquote","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The token is shown once on this screen. To find it again later, go to ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Settings → Data inputs → HTTP Event Collector"]},"."]}]},{"$$mdtype":"Tag","name":"blockquote","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Indexer acknowledgement must stay off."]}," Splunk Cloud does not support it for HEC except through AWS Kinesis Firehose, and Capsule does not use it. Delivery is at-least-once with client-side retry."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-2-create-the-siem-integration-in-capsule","__idx":4},"children":["Step 2: Create the SIEM integration in Capsule"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["In Capsule, go to ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Settings → SIEM"]}," and click ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Add integration"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Set ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Destination"]}," to ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Splunk (HEC)"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Enable the event types you want: ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Detections"]},", ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Findings"]},", ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Policy violations"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Choose an ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Event detail"]}," level:",{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Full"]}," sends the whole envelope, matching the S3 export byte for byte."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Compact"]}," omits activity message bodies. Splunk bills by ingested volume and those bodies dominate an event's size, so use Compact if the transcript is not what you search on."]}]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Paste the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["HEC URL"]}," and ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["HEC token"]}," from Step 1. The token is stored encrypted and never shown again."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Optionally set an ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Index"]},". Leave it blank to use the token's default index."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Leave ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Sourcetype prefix"]}," blank unless you have a naming standard - the Technology Add-on expects ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["capsule"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Click ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Save"]},", then ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["enable"]}," the integration. A new integration starts disabled and exports nothing until you turn it on."]}]},{"$$mdtype":"Tag","name":"blockquote","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Use the row menu's ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Send test event"]}," to confirm the endpoint, token, and index before you rely on it. The ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Delivery"]}," column on the SIEM list shows the outcome of the most recent attempt, and the details drawer shows the last error in full."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-3-optional-install-the-capsule-technology-add-on","__idx":5},"children":["Step 3 (optional): Install the Capsule Technology Add-on"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Events are searchable in your index as soon as Step 2 is done. The add-on is only needed for CIM normalisation, so skip this step if you search the raw JSON directly or normalise it yourself."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Install it if you run ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Enterprise Security"]},". ES detections run ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["tstats"]}," over accelerated data models with ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["summariesonly=true"]},", which returns nothing for data that is not CIM-mapped, so without the add-on ES stays blind to Capsule events."]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Install ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Capsule Security Add-on (TA-capsule)"]}," from Splunkbase onto your search heads. Also install it on indexers or heavy forwarders if you route these events through one."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Add the index your HEC token writes to, to the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["index allow-list of every CIM data model"]}," you expect Capsule events in: ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Splunk_SA_CIM → Settings → Data Model Indexes"]},"."]}]},{"$$mdtype":"Tag","name":"blockquote","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Do not skip the allow-list."]}," An index missing from it never enters the accelerated summary, and every ES detection over that model silently misses Capsule events. Nothing errors."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Confirm the events are landing and normalised:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"header":{"controls":{"copy":{}}},"source":"| tstats summariesonly=false count from datamodel=Alerts where nodename=Alerts source=\"capsule:siem-export\" by sourcetype\n"},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"what-arrives-in-splunk","__idx":6},"children":["What arrives in Splunk"]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"sourcetypes","__idx":7},"children":["Sourcetypes"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Sourcetype"},"children":["Sourcetype"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Event"},"children":["Event"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["capsule:detection"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["A detection raised on AI agent activity"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["capsule:finding"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["A posture or configuration finding on an AI resource"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["capsule:policy_violation"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["A policy violation with the evidence behind it"]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Every event is sent with ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["source=capsule:siem-export"]}," and ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["host=capsule"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"event-envelope","__idx":8},"children":["Event envelope"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Each event carries the same envelope, with the record under ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["event"]},":"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"json","header":{"controls":{"copy":{}}},"source":"{ \"schemaVersion\": 2, \"eventType\": \"policy_violation.created\", \"tenantId\": \"...\", \"exportedAt\": \"...\", \"event\": { ... } }\n","lang":"json"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This is the same envelope the S3 destination writes, so a tenant exporting to both sees identical content."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Every event carries its anchor resource in full - id, name, type, external id, parent, and the environment and connector it was discovered through - so events correlate against the rest of your inventory without a lookup."]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["policy_violation.created"]}]}," is self-contained: the violation, the policy that raised it including its conditions, and the complete finding, detection and activity records the decision was made on."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["detection.created"]}]}," carries the detection, its evidence, and the session activities it was raised on."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["finding.created"]}]}," carries the finding, its evidence, and its remediation steps."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Triage state is exported on all three. Secrets Capsule identified in evidence are masked to a short prefix before export, in evidence text and activity message bodies alike."]},{"$$mdtype":"Tag","name":"blockquote","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["One violation, one event."]}," A violation is exported once, when it is first raised. If it is later resolved and the same condition re-triggers, Capsule reuses the existing violation and does not emit a second ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["policy_violation.created"]},"."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"cim-mapping","__idx":9},"children":["CIM mapping"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The add-on populates ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Alerts"]}," from all three sourcetypes, and additionally ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Intrusion Detection"]}," from ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["capsule:detection"]},"."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["No other data model is claimed. CIM has no AI or agent model, and Capsule does not carry the fields Web, Authentication or Change require - a partial mapping returns misleading results under ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["summariesonly=true"]},"."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Capsule does not rank detections or findings, so those arrive with ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["severity=\"unknown\""]},". Policy violations carry Capsule's own severity, which already uses the CIM vocabulary (",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["low"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["medium"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["high"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["critical"]},")."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"delivery-behaviour","__idx":10},"children":["Delivery behaviour"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Batching"]}," - events are gzipped and split to stay under Splunk Cloud's 1 MB HEC request limit. Splunk Enterprise defaults far higher; Capsule holds both to the Cloud limit."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Oversized events"]}," - a single event that still exceeds the limit after compression is rejected and surfaced on the integration, never truncated. Switching ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Event detail"]}," to Compact is the fix."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Retries"]}," - Capsule retries on ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["429"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["5xx"]},", and network errors with exponential backoff, honouring ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Retry-After"]},". A rejected token or a disallowed index is not retried - it is a configuration error and is reported instead."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Visibility"]}," - the outcome of the most recent attempt is shown per integration in ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Settings → SIEM"]},", with the full error in the details drawer."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Backfill"]}," - export begins when the integration is enabled. Events raised before that are not sent."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"troubleshooting","__idx":11},"children":["Troubleshooting"]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"splunk-rejected-the-index-http-400-code-7","__idx":12},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Splunk rejected the index"]}," (HTTP 400, code 7)"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The index you configured is not on the HEC token's allowed-index list. Add it in Splunk under ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Settings → Data inputs → HTTP Event Collector"]},", edit the token, or clear the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Index"]}," field in Capsule to use the token's default."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"splunk-rejected-the-hec-token-http-401-or-403","__idx":13},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Splunk rejected the HEC token"]}," (HTTP 401 or 403)"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The token is wrong, disabled, or was regenerated in Splunk. Paste the current value into the integration and save - leaving the field blank keeps the old token."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"events-are-in-the-index-but-enterprise-security-sees-nothing","__idx":14},"children":["Events are in the index but Enterprise Security sees nothing"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Almost always the CIM index allow-list. Confirm the index is listed for the Alerts and Intrusion Detection data models in ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Splunk_SA_CIM → Settings → Data Model Indexes"]},", then rebuild acceleration."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If the allow-list is right, check the sourcetype: a custom ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Sourcetype prefix"]}," in Capsule needs a matching ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["local/props.conf"]}," override in the add-on."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"nothing-arrives-at-all","__idx":15},"children":["Nothing arrives at all"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Confirm the integration is ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["enabled"]}," and at least one event type is turned on."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Use ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Send test event"]}," - it reports the exact error from Splunk."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["If your Splunk Cloud stack has an IP allow-list configured, Capsule's egress addresses need to be on it. Contact support for the current list."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"support","__idx":16},"children":["Support"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For help with this integration, contact ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"mailto:support@capsule.security"},"children":["support@capsule.security"]},"."]}]},"headings":[{"value":"Splunk SIEM Integration","id":"splunk-siem-integration","depth":1},{"value":"Overview","id":"overview","depth":2},{"value":"Prerequisites","id":"prerequisites","depth":2},{"value":"Step 1: Create a HEC token in Splunk","id":"step-1-create-a-hec-token-in-splunk","depth":2},{"value":"Step 2: Create the SIEM integration in Capsule","id":"step-2-create-the-siem-integration-in-capsule","depth":2},{"value":"Step 3 (optional): Install the Capsule Technology Add-on","id":"step-3-optional-install-the-capsule-technology-add-on","depth":2},{"value":"What arrives in Splunk","id":"what-arrives-in-splunk","depth":2},{"value":"Sourcetypes","id":"sourcetypes","depth":3},{"value":"Event envelope","id":"event-envelope","depth":3},{"value":"CIM mapping","id":"cim-mapping","depth":3},{"value":"Delivery behaviour","id":"delivery-behaviour","depth":2},{"value":"Troubleshooting","id":"troubleshooting","depth":2},{"value":"Splunk rejected the index (HTTP 400, code 7)","id":"splunk-rejected-the-index-http-400-code-7","depth":3},{"value":"Splunk rejected the HEC token (HTTP 401 or 403)","id":"splunk-rejected-the-hec-token-http-401-or-403","depth":3},{"value":"Events are in the index but Enterprise Security sees nothing","id":"events-are-in-the-index-but-enterprise-security-sees-nothing","depth":3},{"value":"Nothing arrives at all","id":"nothing-arrives-at-all","depth":3},{"value":"Support","id":"support","depth":2}],"frontmatter":{"seo":{"title":"Splunk SIEM Integration"}},"lastModified":"2026-11-02T11:57:20.610Z","pagePropGetterError":{"message":"","name":""}},"slug":"/guides/splunk-siem","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}