Splunk HEC setup

Integration to send P0 audit logs to Splunk instance.

P0 integrates with Splunk HEC (HTTP Event Collector) to forward audit logs from your P0 tenant to your Splunk instance.

Prerequisites

• Existing P0 account at p0.app

• Splunk Instance Admin Role

• Public-facing Splunk instance with HEC endpoint secured by an SSL certificate.

  • The SSL certificate must be signed by a trusted Certificate Authority (CA) to ensure secure communication. Self-signed certificates are not allowed by P0 Security.

• Splunk HEC Token

Set up Splunk HEC token

This setup takes about 5 minutes.

1. Log in to p0.app and select Integrations. Under Security Information & Event Managers, select Splunk, then select the HTTP Event Collector component:

   
2. Click on "Add Token" to install.

   
3. Enter a unique custom identifier for the token and click "Next":

1. Enter the desired configuration and click "Finish" to complete the installation. See the configuration section for information about the settings.

   

Configuring Splunk HEC token

Endpoint

HTTPS endpoint with valid SSL certificate. The instance port number required to form the URL can be found in the "Global Settings" within the HEC Settings page.

example: https://hec.example.com:8088/

Token

Tokens are 32 character GUIDs that let logging agents and HTTP clients connect to the HEC input.

Refer to the official Splunk documentation for detailed instructions: Set up HTTP Event Collector.

Congratulations! You are now set up with Splunk audit logs integration.