Splunk alert channel
You can configure FortiCNAPP to forward alerts to Splunk using an HTTP Event Collector (HEC).
FortiCNAPP forwards alerts to Splunk using a destination port of either 80 or 443. If Splunk is configured to use another port (for example, 8088) you must set up port forwarding.
FortiCNAPP does not support the use of self-signed SSL/TLS certificates for the Splunk server URL.
Creating a Splunk HTTP event collector
To create a Splunk HTTP event collector:
- Navigate to Settings > Data Inputs.
- In the HTTP Event Collector row, select + Add new.
- On the Select Source page:
- Provide a name for your token.
- Optionally, override the default source name and provide a description. For example, lacework_alerts and HEC for Lacework Alerts.
- Optionally, specify an Output Group.
- At the top of the page, click Next.
- On the Input Settings page:
- Specify a Source type or leave as automatic. FortiCNAPP sends the data as json, so you can explicitly choose _json under Structured.
- Choose an App Context as applicable to your Splunk design and use.
- Choose Indexes as applicable to your Splunk design and use.
- At the top of the page, click Review.
- On the Review page, review your inputs, and click Submit at the top of the page.
You should see the message Token has been created successfully. Copy the token, index, source and resolvable hostname or IP address of your Splunk instance.
Creating a Splunk alert channel
To create a Splunk alert channel:
- Log in to the console as a user with administrative privileges.
- Go to Settings > Notifications > Channels.
- Click + Add new.
- Select Splunk.
- Click Next.
- Verify that you have created your Splunk HTTP event collector as described in Create a Splunk HTTP Event Collector.
- Name the channel.
- Enter your Splunk HEC token.
- Optionally, enter a Splunk channel.
- Enter the resolvable hostname or IP address of your Splunk instance (such as
http-inputs-<customer>.splunkcloud.com). Do not include the port number beforehttp://and exclude/services/collectorat the end of the hostname or IP address. - Enter the destination port for forwarding events [
80or443]. - Check the SSL box if appropriate.
- Enter your Splunk index.
- Enter your Splunk source.
- Click Save.
- Click Alert Rules and configure your required alert routing details by leveraging the alert channel you created.
To test your alert channel, click Test. You should see a confirmation of the test and a single alert sent to Splunk with the field-value pair of 'host :login.lacework.net'. You should start to receive FortiCNAPP alert notifications in Splunk.
Creating a FortiCNAPP Splunk alert channel using Terraform
For organizations using Terraform to manage their environments, FortiCNAPP maintains the Terraform provider, which enables configuration of alert channels using automation.
For a complete list of custom Terraform resources to manage alert channels in FortiCNAPP, see Manage alert channels with Terraform.
resource "lacework_alert_channel_splunk" "ops_critical" {
name = "OPS Critical Alerts"
hec_token = "BA696D5E-CA2F-4347-97CB-3C89F834816F"
host = "localhost"
port = "80"
event_data {
index = "index"
source = "source"
}
}
Additional information on the lacework_alert_channel_splunk resource can be found on the Terraform Registry.