Splunk Cloud integration

Jit's integration with Splunk Cloud makes it easy to stream your audit logs to Splunk for storage and analysis using Splunk's event collector.

You can learn more about Jit's audit logs here.

Quickstart

1. In Jit's web app, go to the Integrations page.

2. Find the "Splunk Cloud" card and click "Connect".

3. You should now see a Splunk integration window. Click on "Connect" at the top right corner.

   

   • You will now need to provide your deployment name (from your splunk URL) and the HTTP Event Collector (HEC) token that will be used to send events.

     

   • Fill in the 3 values:

     • Deployment Name - for example, if your personal splunk URL is https://mycompany.splunkcloud.com:443then fill in mycompany.
     • Port - The port in your personal URL, for example if your personal splunk URL is https://mycompany.splunkcloud.com:443 then fill in 443.
       Note - some deployments can also use 8088.
     • Event collector token - The token to ingest data into splunk, Please continue reading to obtain it.

   • Log into your Splunk Cloud account.

   • Navigate to Settings > Data Inputs

   

   • Under Local Inputs, HTTP Event Collector click Add new

   

   • Follow these steps:

     • Name your token (e.g., "Jit Integration").

     • Make sure Enable indexer acknowledgement is Unchecked

       

   • Click Next

   • Choose the indexes that will ingest Jit's audit logs (under Selected items(s))

     

   • Click Review -> Submit and copy the generated token. Please note that if the token is deleted or modified, events from Jit will no longer be logged to Splunk Cloud.

   

   Learn more in Splunk documentation.

4. Paste the token in the "Event collector token" textbox and click Continue.

   If the token is valid, your integration is now active, and you can begin ingesting audits to your instance.

5. Enable audits ingest, and select the desired index. The index must be included in your token configuration.

Sample event

{
   "severity":"Info",
   "action":"Export plan results",
   "description":"Export Plan Test Plan results",
   "userAgent":"Mozilla/5.0",
   "ip":"192.168.0.1",
   "email":"[email protected]",
   "plan_name":"Test Plan"
}

Whitelisting IPs

If needed, you can whitelist the following IPs from which the events originate:

• 18.205.92.162
• 18.215.215.164
• 34.225.59.94
• 44.210.155.28
• 52.45.12.206
• 54.235.127.238

Notes

• Ensure that the Splunk HEC endpoint is accessible from Jit.

• If the token is invalid or the endpoint is inaccessible, You will have to re-integrate.

• The ingestion endpoint that will be used to ingest data is https://[YOUR-DEPLOYMENT-NAME].splunkcloud.com:[YOUR-PORT]/services/collector/event - make sure all configurations are correct.