You can use a webhook to automatically send Cmd alerts to Splunk HTTP Event Collectors (HECs). You can customize the webhook to select which CQL properties to send.
Prerequisites:
Custom webhooks must first be globally enabled by a global administrator.
You need access to Splunk Cloud to use the HTTP event collector.
Splunk setup
Follow Splunk's guide to set up an HEC, and as you do:
set the Source type to "_json"; and,
do not use indexer acknowledgement .
Cmd setup
In the Cmd web app:
Open the drop-down menu in the top-right.
Select Project & app settings.
On the left-hand menu, under 'Project settings', select Integrations preferences.
Select Webhook.
Click Add integration in the top-right corner.
In the pop-up, name your integration (e.g., "Splunk 1").
Under "Webhook URL", enter
https://jthaim7ka5.execute-api.us-west-2.amazonaws.com/api/forwarder.Under "Custom JSON to send", enter the following:
{
"splunk_endpoint_url": "[URL]",
"splunk_http_key": "[KEY]"
}Replace
[URL]with the correct HEC URI for your Splunk implementation. Use the/services/collector/rawendpoint.Replace
[KEY]with your HEC's 'token value'.
You can now test the integration by copying the curl command and executing it in your terminal. Once executed, you will receive an example alert in Splunk.
Now, you can add Splunk alerts to any of your triggers.
Related resources
An overview of third party integrations