Skip to content

Exporting Alerts to Splunk

Set Up the Splunk Cloud Instance to receive the alerts

To receive the events from the sensor, we will set up a HTTP Event Collector in the Splunk instance following the below steps

  1. Login to the Splunk Instance and click Add Data.

    Select Add Data

  2. Click Monitor.

    Click Monitor

  3. Click HTTP Event Collector.

  4. Enter the preferred name for the event collector and click Next.

    Enter the name for the HTTP Event Collector

  5. Set the Source Type as _json and click Review.

    Set the Source Type as _json

  6. Review the details and click Submit.

    Review the details and click Submit

  7. The token value for the event collector will be listed in this step. Copy the token value and paste it in /etc/sophos/runtimedetections-rules.yaml.

    Copy the token value

  8. The details of the Event Collector can be viewed from Settings > Data Input.

    View the Event Collector Details

  9. Click HTTP Event Collector.

    Click on HTTP Event Collector

  10. You can add a new token or view the details of the tokens that were created already.

    View the token details

Some versions of Splunk don't enable the HTTP Event Collector tokens by default. If the Status column shows Disabled, click Global Settings and All Tokens: Enabled.

The token should have Enable Indexer Acknowledgement unchecked. This is found in Actions > Edit on the token details. If checked, it causes an error Data channel is missing.

Configuring Sophos Linux Sensor to send Alerts to a Splunk cloud instance

  1. Update  /etc/sophos/runtimedetections-rules.yaml and add the output type webhook as shown below.

    Here's an example:

    alert_output:
    outputs:
        - type: webhook
        enabled: true
        url: https://<splunk-cloud-instance>:8088/services/collector/event
        template: '{**event**: {{AlertJSON .}}}'
        headers:
            "Authorization": "Splunk <token>"
            "Content-Type": "application/json"
    

    url: Splunk instance URL followed by :8088/services/collector/event.

    token: Splunk token can be obtained while setting up the http event collector.

  2. Restart the sensor after updating the /etc/sophos/runtimedetections-rules.yaml.

    $ sudo systemctl restart sophoslinuxsensor

  3. Now the sensor is set up to send the alerts to Splunk cloud instance.

More information

Back to top