Splunk Enterprise
Configure Splunk Enterprise integration with RAD Security to query security data.
This guide walks you through integrating Splunk Enterprise with RAD Security to enable querying security data from Splunk for enrichment and correlation within RAD Security.
Splunk Enterprise provides powerful search and analysis capabilities for security data. RAD Security integrates with Splunk to pull relevant security events and logs for correlation with runtime security detections.
Prerequisites
Before you begin, ensure you have:
- Admin access to Splunk Enterprise
- Splunk Enterprise instance (version 8.0 or later recommended)
- Ability to create authentication tokens in Splunk
- Access to RAD Security workspace with integration permissions
Splunk Enterprise Only: RAD Security's Splunk integration uses authentication tokens for querying data, which is only available in Splunk Enterprise. This feature is not available in Splunk Cloud free trials.
Service User Recommended: Create a dedicated service user for this integration rather than using a personal account. This ensures the integration continues working when team members leave or change roles.
Step 1: Enable Token Authentication
Configure authentication tokens to allow RAD Security to query data from Splunk.
Log in to Splunk Enterprise
Log in to Splunk Enterprise with administrator privileges
Enable Token Authentication
If token authentication is not already enabled:
- Navigate to Settings > Authentication methods
- Enable Token authentication
- Click Save
Token authentication is typically enabled by default in Splunk Enterprise 7.3 and later.
Step 2: Create Service User (Recommended)
Create a dedicated service user for the RAD Security integration to ensure continuity and proper access control.
Navigate to User Management
Go to Settings > Users and authentication > Access controls > Users
Create New User
- Click New User
- Enter user details:
- Username (e.g., "rad-security-service")
- Full name (e.g., "RAD Security Integration")
- Email address - Use a service email (e.g.,
rad-security@company.com) - Password - Create a secure password
Assign Roles
Assign the appropriate role(s) to the service user. At minimum, the user needs:
- user role - Basic search capabilities
- Custom role with read access to relevant indexes (optional, for more granular control)
You can create a custom role with only the specific permissions needed for RAD Security queries if you prefer least-privilege access.
Save User
Click Save to create the service user
Alternative: You can use an existing service account if one is already configured with appropriate search permissions.
Step 3: Create Authentication Token
Navigate to Token Management
Go to Settings > Tokens
Create New Token
- Click New Token
- Enter a Token name (e.g., "RAD Security Query Token")
- Select the User - Choose the service user created in Step 2
- Set Audience - Leave as default (system) or set to specific audience if required
- Set Expiration time:
- Recommended: 90 days or less for security best practices
- Or set to match your organization's token rotation policy
Setting an expiration date requires you to rotate the token periodically, but it's a security best practice.
Generate Token
- Click Create
- Immediately copy the authentication token that appears
This is your only chance to view the token! If you lose it, you'll need to revoke and create a new token. Store it securely in a password manager or secrets vault.
Note API Endpoint URL
Your Splunk API endpoint URL will be in the format:
https://<splunk-host>:8089
Replace <splunk-host> with your Splunk server hostname or IP address.
Port 8089 is the default Splunk management port. If your Splunk instance uses a different port, use that instead.
For detailed instructions, see Splunk's token authentication documentation.
Step 4: Configure in RAD Security
Navigate to your RAD Security workspace and configure the Splunk Enterprise integration with the following parameters:
Required Parameters
| Parameter | Description | Example |
|---|---|---|
| Search Service URL | Splunk management API endpoint | https://splunk.company.com:8089 |
| Search Service Token | Authentication token from Step 3 | your-auth-token-here |
The API URL should be your Splunk management port (default: 8089). This is different from the web interface port (8000) or HEC port (8088).
Port Configuration: If your Splunk instance uses a non-standard management port, update the port number in the API URL accordingly.
Verify Integration
After completing the setup, verify your integration is working:
Check Connection Status
- Navigate to Data Sources > Integrations > SIEM in RAD Security
- Locate your Splunk Enterprise integration
- Verify the connection status shows as Connected
Your Splunk Enterprise integration is now configured! RAD Security can query security data from Splunk for enrichment and correlation.
What Data Can Be Queried
RAD Security can query the following data types from Splunk:
Use Cases
Security Event Enrichment Enrich RAD Security runtime detections with historical context from Splunk logs.
Cross-Platform Correlation Correlate RAD Security runtime events with network, endpoint, and application logs stored in Splunk.
Threat Investigation Query Splunk for additional context when investigating security incidents detected by RAD Security.
Historical Analysis Access historical security data from Splunk to establish baselines and identify anomalies.
IoC Validation Validate indicators of compromise by querying Splunk's threat intelligence and historical data.
Compliance Evidence Pull compliance-relevant logs from Splunk to support RAD Security's audit and compliance workflows.
Troubleshooting
Security Best Practices
Use Service Accounts Always use a dedicated service account with a service email, never a personal account tied to an individual.
Rotate Tokens Regularly Set token expiration periods and rotate before expiry. Recommended: 90 days or less.
Least Privilege Access Grant only the minimum search permissions required. Use custom roles for granular access control.
Enable SSL/TLS Always use HTTPS for the API endpoint. Use valid SSL certificates in production environments.
Monitor Token Usage Regularly review authentication token usage in Splunk to detect anomalous query activity.
Restrict Network Access Configure firewall rules to only allow port 8089 connections from RAD Security IP addresses.
Secure Token Storage Store tokens in a secure password manager or secrets vault. Never commit tokens to version control.
Audit Search Activity Regularly review search activity by the service user to ensure queries align with expected behavior.
Index-Level Permissions Use index-level permissions to limit which data the service user can query.
Document Token Expiration Maintain documentation of token expiration dates to enable proactive rotation.
Token Rotation
To rotate your Splunk authentication token:
Create New Token
- Log in to Splunk Enterprise as admin
- Navigate to Settings > Tokens
- Create a new authentication token for the same service user
- Use a different label to distinguish it from the old token
Update RAD Security Integration
Update the authentication token in RAD Security integration settings
Verify Connectivity
Test that queries still work with the new token
Revoke Old Token
Once verified, revoke the old token in Settings > Tokens
Token Rotation Schedule: Set calendar reminders 1-2 weeks before token expiration to ensure uninterrupted service.
Additional Resources
Authentication Tokens
Official Splunk guide to creating and managing authentication tokens
Splunk REST API
Complete reference for Splunk's REST API
Search Reference
Splunk Search Processing Language (SPL) reference
User Access Control
Learn about Splunk users, roles, and permissions