Sending audit data to Splunk Cloud

You can configure the SOAR Platform to send audit log data to the Splunk Cloud. The audit messages that are sent to Splunk are similar to the audit messages that are included in Syslog.

Before you begin

The audit log must be enabled on the SOAR Platform as described in Configuring audit logging.
You must have an administrator account on your Splunk Cloud instance.
You must have the HEC token value for your Splunk deployment.

About this task

Sending audit data to Splunk Cloud depends on Splunk HEC and the network connection between the SOAR Platform and your Splunk server.

Complete the following steps to configure the SOAR Platform to send audit data to Splunk Cloud.

Procedure

Determine the Splunk hostname to which you want to send data for your Splunk server deployment. To determine whether your deployment is self-service or managed, examine the format of the URL that you use to connect to Splunk Cloud. For more information, see the Splunk Cloud User Manual.
If the domain name is not listed on a DNS server, add the IP address and domain name pair to the /etc/hosts file.
1. Open the /etc/host file by entering the following command.
```
sudo vi /etc/hosts
```
2. Add the following line to the /etc/hosts file.
```
<IP Address> <hostname>
```
For example,
```
11.22.33.4444 splunk3-01.internal.examplecompany.com
```
Enable HEC on your Splunk Web application. The steps to enable HEC depend on whether your deployment is self-service or managed. For more information about how to enable HEC, see the Splunk documentation.
Create an HEC token for the SOAR Platform on your Splunk instance. This procedure differs depending on whether your Splunk deployment is self-service or managed. For more information, see the Splunk documentation.

Set the Splunk properties on the SOAR Platform for the connection to Splunk Cloud by using the HEC token value and the hostname that you modified in the previous step. SSH to the SOAR Platform and enter the following commands in the order shown. The hostname requires a prefix for self-service or managed Splunk Cloud. For self-service, it is

HOSTNAME =
input-<fully_qualified_hostname>

and for managed Splunk Cloud it is

HOSTNAME =
http-inputs-<fully_qualified_hostname>

. For more information, see the Splunk documentation documentation.

sudo resutil configset -key "splunk_audit_connection.is_enabled" -bvalue true
sudo resutil configset -key "splunk_audit_connection.hostname" -svalue <http-inputs-resilient.splunkcloud>
sudo resutil configset -key "splunk_audit_connection.port" -ivalue <port_number>
sudo resutil keyvaultset -name "splunk_audit_connection_token"

When prompted, enter the token value. Then, enter the following commands.

sudo resutil configset -key "splunk_audit_connection.source" -svalue "Resilient"
sudo resutil configset -key "splunk_audit_connection.source_type" -svalue "Resilient"

To verify that the properties are set correctly, enter the following commands.

sudo resutil configget -key "splunk_audit_connection.is_enabled"
sudo resutil configget -key "splunk_audit_connection.hostname"
sudo resutil configget -key "splunk_audit_connection.port"
sudo resutil keyvaultget -name "splunk_audit_connection_token"
sudo resutil configget -key "splunk_audit_connection.source_type"
sudo resutil configget -key "splunk_audit_connection.source"

Restart the Resilient® service, as follows.
```
service resilient restart
```
Verify that the configuration is successful by searching for Resilient audit messages in your Splunk instance. Enter the following search.
```
source="Resilient"
```

Results

The SOAR Platform is configured to send audit log data to the Splunk Cloud.

To disable sending audit messages to the Splunk Cloud, enter the following command.

resutil configset -key "splunk_audit_connection.is_enabled" -bvalue false

Then, restart the Resilient service.

What to do next

Monitor audit messages on Splunk. If the Splunk HEC fails to receive or handle an audit log message, an error might be logged in the SOAR client.log file. It can happen when the connection is refused or dropped or an HEC token is disabled. To detect it, monitor the audit messages on Splunk. If you suspect missing audit data, search the client.log for ERROR com.co3.audit.SplunkOnErrorHandler - Error sending audit log message from Resilient to Splunk. If needed, turn auditing off and on again to force the SOAR Platform to establish a new connection to the Splunk server.