This article outlines the steps required to ship Cloud Control Center audit logs to Splunk.
Cloud Control Center audit logs can be shipped to Splunk by using the Splunk external monitor. Audit logs include Cloud Control Center authentication events, device attach events, consistency error events, and more.
Prerequisites
-
Minimum Cloud Control Center version 14.8
- Splunk HTTP Event Collector Token
- Splunk HTTP Event Collector URL and Port (or other supported HTTP Event Collectors such as Cribl)
- Inbound firewall rules/NAT to allow Cloud Control Center to reach the Event Collector
Splunk Instructions
1. Log into Splunk and navigate to Settings > Data Inputs
2. Select HTTP Event Collector in the list of options
3. Select New Token on the Data Inputs page
4. Give the token a name of your choice. You can leave the rest of the settings at their default values and select Next at the top.
5. Select the Splunk index you wish to use or create a new one and move it from the Available Items list to the Selected Items list. You can leave the rest of the settings at their default values and select Review at the top.
6. Review the configuration changes for accuracy and select Submit.
7. Go back to the HTTP Event Collector page to collect the newly generated token.
If leveraging Cribl as your HTTP Event Collector, you can find or generate a new Token Value in Data -> Sources -> Splunk -> HEC -> Configure -> Auth Tokens as seen below.
NOTE:
Be sure to use the URL and Port of your Cribl HEC Collector when configuring the Splunk external monitor in Cloud Control Center as shown in the next section.
Elisity Cloud Control Center Instructions
1. Log into Elisity Cloud Control Center, navigate to Monitoring > External Monitors, and select + Add External Monitor.
2. In the Add External Monitor panel, locate the Splunk tile and select Configure.
3. Provide the URL of your Splunk, or Cribl, HTTP Event Collector, including the scheme (for example, https://splunk.example.com), the Port, the Token you generated earlier, and the Index you specified in step 5 of the Splunk instructions. Leave Source Type set to Json unless your Splunk deployment requires a different source type. Select Submit.
NOTE:
If your Splunk instance does not have a certificate installed, you must select Ignore Certificate.
4. The Splunk monitor is now listed on the External Monitors page and shows an Active state, indicating that log forwarding is enabled.
5. You should now be able to see Cloud Control Center audit logs show up in Splunk.