Sending Logs to Splunk HEC
This feature is available starting from Snare Central v8.7.0
Overview
Snare Central (Reflector) can forward log data to Splunk using the HTTP Event Collector (HEC), enabling flexible and customizable integration with Splunk’s data analysis and monitoring capabilities.
By leveraging Snare Reflector's advanced filtering, transformation, and remapping features, organizations will have fine-grained control over log data flow, ensuring that logs are correctly formatted and efficiently ingested into Splunk HEC indexes. This setup enables custom routing and filtering, forwarding only relevant data to designated indexes. The result is enhanced data visibility, improved operational efficiency, and streamlined integration between Snare Central and Splunk, supporting effective search, analysis, and security monitoring within the Splunk ecosystem.
This guide outlines the steps to set up log delivery from Snare Reflector to Splunk using the HEC interface. It covers how to define the necessary Splunk components and configure Snare Reflector to forward logs into your Splunk indexes, enabling you to leverage Splunk’s search and monitoring capabilities for enhanced cybersecurity threat detection, investigation, and response.
Splunk Components Preparation and Setup
To enable log forwarding from Snare Reflector to Splunk via HTTP Event Collector (HEC), a set of Splunk components must first be configured. These components define how the logs are ingested, where they are indexed, and how access is authenticated and secured.
The HTTP Event Collector (HEC) in Splunk allows external applications like Snare Reflector to send log data directly to a Splunk deployment over HTTP or HTTPS protocols. HEC uses a token-based authentication model, enabling secure data transmission without the need for a Splunk forwarder. Once HEC is enabled, you can generate a token and configure Snare Reflector to send log data to Splunk indexes in a specific format.
This setup eliminates the need for Splunk credentials to be included in the application, simplifying the integration. Snare Reflector will push processed log data to Splunk HEC, where it will be indexed and available for querying and analysis.
This section will guide you through preparing the required Splunk resources for setting up HTTP Event Collector (HEC) for log forwarding.
You will configure the following components:
Index Configuration – Defines where the incoming logs will be stored in Splunk.
HEC Endpoint – The HTTP endpoint that receives the data from Snare Reflector.
HEC Token – Authenticates Snare Reflector for sending data to Splunk over HTTP or HTTPS.
Once these components are set up, you'll be ready to connect Snare Reflector and begin sending log data to Splunk via HEC for indexing and analysis.
Create Index in Splunk for HEC
To forward logs to Splunk using the HTTP Event Collector (HEC), you first need to create and configure an index where the logs will be stored. This process ensures that logs sent from Snare Reflector are properly categorized and indexed for easy search and analysis.
Log in to Splunk Web using your administrator credentials and access your Splunk instance via the web interface.
Navigate to Settings > Indexes. (Under the DATA section, click on Indexes).
Create a New Events Index. (On the Indexes page, click New Index).
Fill in the following fields:
Index Name: Enter a unique name for the index, such as
snare_logsor another descriptive name.Index Data Type: Select Events for events data. This is the default data type.
Home Path: Choose or define a path where the index data will be stored. Leave blank for default.
Cold Path: Specify the path for data storage once it's archived. Leave blank for default.
Thawed Path: Specify the path for thawed data (data that is retrieved from frozen archives). Leave blank for default.
Data Integrity Check: Enable/Disable data integrity check.
Max Size of Entire Index: Set the maximum size of the entire index.
Max Size of Hot/Warm/Cold Bucket: Set the maximum size of each index bucket. When setting the maximum size, use
auto_high_volumefor high volume indexes otherwise, useauto.Frozen Path: Set this field if you want to archive frozen buckets. Leave blank for default.
App: The app in which the index resides.
Tsidx Retention Policy: The tsidx retention policy.
After filling in the required fields, click Save to create the index.
Verify Index Creation:
Once the index is created, it will appear in the Indexes list.
Ensure that the index is listed and its status is Enabled.
Follow the detailed steps here:
Create events indexes - For Splunk Enterprise.
Manage Splunk Cloud Platform indexes - For Splunk Cloud Platform.
Take note of the Index Name value, this will be required later when configuring Splunk’s HEC Token and Snare Reflector's HEC Index for Splunk HEC destination.
Configure HEC Endpoint
Next, you need to configure the HEC endpoint in your Splunk instance. The HEC endpoint is where Snare Reflector will send the logs over HTTP or HTTPS.
In the Splunk Web, navigate to Settings > Data inputs. (Under the DATA section, click on Data Inputs).
On the Data Inputs page, find and click on HTTP Event Collector.
Click Global Settings.
In the All Tokens toggle button, select Enabled.
Configure the following fields:
Default Source Type: Under Structured select _json or json_no_timestamp.
Default Index: (Optional) Choose a default index for all HEC tokens.
Default Output Group: (Optional) Choose a default output group for all HEC tokens.
Use Deployment Server: (Optional) Use a deployment server to handle configurations for HEC tokens.
Enable SSL: (Optional) To have HEC listen and communicate over HTTPS rather than HTTP.
HTTP Port Number: (Optional) Enter a number in the HTTP Port Number field for HEC to listen on.
After configuring the required fields, click Save.
Follow the detailed steps here:
Configure HTTP Event Collector on Splunk Enterprise - For Splunk Enterprise.
Configure HTTP Event Collector on Splunk Cloud Platform - For Splunk Cloud Platform.
Take note of the HTTP Port Number value (Default is 8088) and if you enabled SSL. This will be required later when configuring Snare Reflector's Splunk HEC destination.
Confirm that no firewall blocks the port number that you specified in the HTTP Port Number field on both the Snare Central and the Splunk instance that hosts HEC.
Create HEC Token
After setting up the HEC endpoint in your Splunk instance, you need to create HEC token, which will be used to authenticate Snare Reflector when sending logs to Splunk. To use HEC, you must configure at least one token.
In the Splunk Web, navigate to Settings > Data inputs. (Under the DATA section, click on Data Inputs).
On the Data Inputs page, find and click on HTTP Event Collector.
Click New Token.
Alternatively:
In the Splunk Web, navigate to Settings > Add Data (Located in the Left Panel with icon)
On the Add Data page, find and click Monitor (You may need to scroll down to locate it)
Click HTTP Event Collector
Configure the following fields:
Name: Enter a descriptive name for the token.
Source name override: (Optional) If set, override the default source value for events that this input generates.
Description: (Optional) Description for the input.
Output Group: (Optional) Select an existing forwarder output group.
Enable indexer acknowledgment: (Optional) To enable indexer acknowledgment for this token.
Click Next.
In Source type, click Select > Select Source Type then under Structured select _json or json_no_timestamp.
Under Index, in the Select Allowed Indexes > Available item(s) select the Index Name previously created in Create Index in Splunk for HEC step.
Click Review then confirm all settings were correct.
After reviewing and confirming that all the settings were correct, click Submit.
Follow the detailed steps here:
Create an Event Collector token on Splunk Enterprise - For Splunk Enterprise.
Create an Event Collector token on Splunk Cloud Platform - For Splunk Cloud Platform.
Copy and take note of the Token Value. This will be required later when configuring Snare Reflector's Splunk HEC destination.
Snare Reflector Setup for Splunk HEC Destination
After preparing and setting up the necessary Splunk components, including enabling the HTTP Event Collector (HEC), generating the HEC token, and configuring the appropriate index and source type, we now proceed with configuring Snare Reflector to send log data directly to Splunk via HEC. This setup ensures seamless log forwarding from Snare Reflector to Splunk for indexing and analysis.
Destination Configuration
To configure Snare Reflector to send logs to Splunk HEC, follow these steps:
Navigate to Reflector UI and open Configure Destination page.
Select + Add Destination tab on the Reflector > Configure Destination page.
Define the following destination details:
Name - Unique user-friendly name of the destination, used for display purposes. Name can contain alphanumeric characters (a-z, A-Z, 0-9), special characters (~!@$%^()_+=-#) and spaces are allowed.
Enable - Indicates whether sending events to this destination will be enabled.
IP/Hostname - The IP address or Hostname for Splunk HEC.
Port - The HTTP Port Number that were previously noted in Configure HEC Endpoint, typically uses port 8088 by default.
Destination Format - Select Splunk HEC format for delivery to Splunk HEC over HTTP protocol.
Protocol - Select HTTP or HTTPS if SSL were enabled during Configure HEC Endpoint.
HEC Token - The Token Value noted in Create HEC Token.
HEC Index - The Index Name noted in Create Index in Splunk for HEC.
Remapping Template - Select the appropriate Fields Remapping template for this destination.
Maximum Size Per Request (in KB) - Should use the default value 5120 unless the maximum size per API request were specifically adjusted in Splunk.
Click ADD DESTINATION then select ADD AND RESTART to save the new destination and restart Snare Reflector services to apply the changes. The configured Splunk HEC destination will now show in the Destinations list and will start sending data (if enabled).
You need to define one destination for each HEC Index.
Any log types not included in the rules of the Remapping Template will bypass the remapping logic and will be forwarded in their original form. If you only want to forward specific log types with fields remapping, you may utilize the Filters feature.
Remapping Template
When sending data to HTTP-based destination format like Splunk HEC, an additional layer of transformation is available using Remapping Template through Fields Remapping. This feature allows Snare log fields to be further refined and mapped to the specific schema expected by the target platform, ensuring compatibility and usability within the receiving system.
Field remapping ensures that log data forwarded from Snare Reflector is correctly understood, searchable, and actionable by the receiving system. This is especially important when forwarding to platforms that require specific schemas or follow normalization models.
To use this feature it is necessary to create a Field Remapping(s), there is 1 Field Remapping template for Splunk HEC provided to help get started quickly.
Detailed steps on how to create/modify Remapping Template can be found in this Fields Remapping user guide link: Fields Remapping.
Troubleshooting Guide
When configuring a Snare Reflector Destination to send logs to Splunk HEC, issues may arise during the setup. This guide covers the common errors that you may encounter:
The destination format of the remapping template is incorrect.
This is typically cause by invalid Remapping Template.
Splunk HEC Destination Status Remains Disconnected
Go to Snare Central > System > Administrative Tools > Display the Snare Central Log Files
Check SnareCollector.log and scroll down near the bottom.
If you found
Cannot connect to HEC: Post "http://<host>:<port>/services/collector/event": dial tcp: lookup xx.xxx.xx.xx: no such hostthis is typically cause by invalid IP/Hostname.
If you found
Cannot connect to HEC: Post "http://<host>:<port>/services/collector/event": dial tcp xx.xxx.xx.xx:xxxx: connect: connection refusedthis is typically cause by invalid Port.
If you found
Cannot feed data to HEC: 400this is typically cause by invalid HEC Index.
If you found
Cannot feed data to HEC: 403this is typically cause by invalid HEC Token.