> For the complete documentation index, see [llms.txt](https://docs.p0.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.p0.dev/integrations/siem-integrations/splunk-hec-setup.md).

# Splunk HEC setup

Integration to send P0 audit logs to Splunk instance.

P0 integrates with Splunk HEC (HTTP Event Collector) to forward audit logs from your P0 tenant to your Splunk instance.

## Prerequisites

* Existing P0 account at [p0.app](https://p0.app/)
* Splunk Instance Admin Role
* Public-facing Splunk instance with HEC endpoint secured by an SSL certificate.
  * The SSL certificate must be signed by a trusted Certificate Authority (CA) to ensure secure communication. Self-signed certificates are not allowed by P0 Security.
* Splunk HEC Token

## Set up Splunk HEC token

{% hint style="info" %}
This setup takes about 5 minutes.
{% endhint %}

1. Log in to [p0.app](https://p0.app) and select **Integrations**. Under **Security Information & Event Managers**, select **Splunk**, then select the **HTTP Event Collector** component:

   <figure><img src="https://3783273641-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSQNwGQz62W737pY0FzVb%2Fuploads%2Fgit-blob-b659dd821c3aadc87996c323e2579420c6dbb419%2FScreenshot%202025-01-24%20at%203.18.10%E2%80%AFPM.png?alt=media" alt="P0 Integrations page with Splunk selected, showing the HTTP Event Collector component"><figcaption></figcaption></figure>
2. Click on "Add Token" to install.

   <figure><img src="https://3783273641-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSQNwGQz62W737pY0FzVb%2Fuploads%2Fgit-blob-86505f36fd6058134f763a2d95f5a7123db65cc3%2FScreenshot%202025-01-24%20at%203.21.07%E2%80%AFPM.png?alt=media" alt="P0 Splunk HTTP Event Collector page showing the installed tokens table and the Add token button highlighted"><figcaption></figcaption></figure>
3. Enter a unique custom identifier for the token and click "Next":

<div align="center" data-full-width="true"><figure><img src="https://3783273641-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSQNwGQz62W737pY0FzVb%2Fuploads%2Fgit-blob-ca39e0edfab12ef90fd518763b6f2cab7df08597%2FScreenshot%202025-01-24%20at%203.24.19%E2%80%AFPM.png?alt=media" alt="Splunk HEC token installation form with the token identifier input field highlighted" width="563"><figcaption></figcaption></figure></div>

4. Enter the desired configuration and click "Finish" to complete the installation. See the [configuration section](#configuring-splunk-hec-token) for information about the settings.

   <figure><img src="https://3783273641-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSQNwGQz62W737pY0FzVb%2Fuploads%2Fgit-blob-4d98cb8dff291faffbee583e6db463cf95c471a3%2FScreenshot%202025-01-24%20at%203.25.25%E2%80%AFPM.png?alt=media" alt="Splunk HEC configuration form with HEC endpoint and HEC token input fields and the Finish button"><figcaption></figcaption></figure>

## Configuring Splunk HEC token

### Endpoint

HTTPS endpoint with valid SSL certificate. The instance port number required to form the URL can be found in the "Global Settings" within the HEC Settings page.

{% hint style="info" %}
example: <https://hec.example.com:8088/>
{% endhint %}

### Token

Tokens are 32 character GUIDs that let logging agents and HTTP clients connect to the HEC input.

{% hint style="info" %}
Refer to the official Splunk documentation for detailed instructions: [Set up HTTP Event Collector](https://docs.splunk.com/Documentation/Splunk/9.4.0/Data/UsetheHTTPEventCollector).
{% endhint %}

{% hint style="success" %}
Congratulations! You are now set up with Splunk audit logs integration.
{% endhint %}