Splunk Webhook

Configure Splunk to forward alerts to Radiant Security

Overview

Splunk is a big data solution that provides security information and event management (SIEM) capabilities for on-premises and cloud environments. After the completion of this guide, Radiant Security will receive alerts configured in your Splunk environment and later on triage them.

To do this, you’ll need to complete the following steps:

• Add the data connector in Radiant Security
• Configure the webhook allow list
• Configure alert actions

Prerequisites

• Splunk Enterprise, Splunk Enterprise Security, or Splunk Cloud
• Admin or Power User access level

Add the data connector in Radiant Security

1.   Log in to Radiant Security.
2.   From the navigation menu, select Settings > Data Connector and click + Add Connector.
3.   Select the Splunk Webhook option from the list and click Data Feeds.
4.   Under Select your data feeds, select Splunk alerts and click Credentials.
5.   Under Credential Name, give the credential an identifiable name (e.g. Splunk - Credentials). 6.   Under Required Credentials, enter a  Connector tag (e.g. webhook_connector). 7.   Click Add Connector.
8.   Open the newly created connector. Under Vendor Configuration, copy the Webhook URL value. You’ll need it for the Configure alert actions section of this guide. 9.   Click Add Connector to save the changes.

Configure the webhook allow list

In this step, you will configure an allow list depending on whether you use Splunk Enterprise or Splunk Cloud.

Splunk Enterprise

1. In $SPLUNK_HOME/etc/system/local, edit the alert_actions.conf file. If the alert_actions.conf file does not exist, you can create it.
2. In the [webhook] section, add the following entry for Radiant Security:

   [webhook] 
   allowlist.webhook1 = ^https:\/\/.*blastradius.* 
   enable_allowlist = true

Splunk Cloud

1. In Splunk Web, click Settings > Server settings > Webhook allow list.
2. Enter a label for the endpoint (e.g. radiant_connector).
3. Enter the following regex pattern for the URI:

   blastradius

Configure alert actions

1. Navigate to Apps > Search & Reporting > Alerts.
2. For each rule you want to forward notifications to Radiant Security, do the following:
   1. Click Edit > Edit Alert.
   2. Scroll down to Trigger Actions.
   3. Click Add Actions and select Webhook.
   4. On the Webhook action, for URL enter the Webhook URL that you copied from Radiant Security’s page.
3. Click Save.

We value your opinion. Did you find this article helpful? Share your thoughts by clicking here or reach to our Product and Customer Success teams at support@radiantsecurity.ai 

Last updated: 2024-08-23