Splunk Enterprise Integration Setup

This guide walks you through integrating Splunk Enterprise with RAD Security to enable querying security data from Splunk for enrichment and correlation within RAD Security. Splunk Enterprise provides powerful search and analysis capabilities for security data. RAD Security integrates with Splunk to pull relevant security events and logs for correlation with runtime security detections.

Prerequisites

Before you begin, ensure you have:

Admin access to Splunk Enterprise
Splunk Enterprise instance (version 8.0 or later recommended)
Ability to create authentication tokens in Splunk
Access to RAD Security workspace with integration permissions

Splunk Enterprise Only: RAD Security’s Splunk integration uses authentication tokens for querying data, which is only available in Splunk Enterprise. This feature is not available in Splunk Cloud free trials.

Service User Recommended: Create a dedicated service user for this integration rather than using a personal account. This ensures the integration continues working when team members leave or change roles.

Step 1: Enable Token Authentication

Configure authentication tokens to allow RAD Security to query data from Splunk.

Enable Token Authentication

If token authentication is not already enabled:

Navigate to Settings > Authentication methods
Enable Token authentication
Click Save

Token authentication is typically enabled by default in Splunk Enterprise 7.3 and later.

Step 2: Create Service User (Recommended)

Create a dedicated service user for the RAD Security integration to ensure continuity and proper access control.

Navigate to User Management

Go to Settings > Users and authentication > Access controls > Users

Create New User

Click New User
Enter user details:
- Username (e.g., “rad-security-service”)
- Full name (e.g., “RAD Security Integration”)
- Email address - Use a service email (e.g., rad-security@company.com)
- Password - Create a secure password

Assign Roles

Assign the appropriate role(s) to the service user. At minimum, the user needs:

user role - Basic search capabilities
Custom role with read access to relevant indexes (optional, for more granular control)

You can create a custom role with only the specific permissions needed for RAD Security queries if you prefer least-privilege access.

Save User

Click Save to create the service user

Alternative: You can use an existing service account if one is already configured with appropriate search permissions.

Step 3: Create Authentication Token

Navigate to Token Management

Go to Settings > Tokens

Create New Token

Click New Token
Enter a Token name (e.g., “RAD Security Query Token”)
Select the User - Choose the service user created in Step 2
Set Audience - Leave as default (system) or set to specific audience if required
Set Expiration time:
- Recommended: 90 days or less for security best practices
- Or set to match your organization’s token rotation policy

Setting an expiration date requires you to rotate the token periodically, but it’s a security best practice.

Generate Token

Click Create
Immediately copy the authentication token that appears

This is your only chance to view the token! If you lose it, you’ll need to revoke and create a new token. Store it securely in a password manager or secrets vault.

Note API Endpoint URL

Your Splunk API endpoint URL will be in the format:https://<splunk-host>:8089Replace <splunk-host> with your Splunk server hostname or IP address.

Port 8089 is the default Splunk management port. If your Splunk instance uses a different port, use that instead.

For detailed instructions, see Splunk’s token authentication documentation.

Step 4: Configure in RAD Security

Navigate to your RAD Security workspace and configure the Splunk Enterprise integration with the following parameters:

Required Parameters

Parameter	Description	Example
Search Service URL	Splunk management API endpoint	`https://splunk.company.com:8089`
Search Service Token	Authentication token from Step 3	`your-auth-token-here`

The API URL should be your Splunk management port (default: 8089). This is different from the web interface port (8000) or HEC port (8088).

Port Configuration: If your Splunk instance uses a non-standard management port, update the port number in the API URL accordingly.

Verify Integration

After completing the setup, verify your integration is working:

Check Connection Status

Navigate to Data Sources > Integrations > SIEM in RAD Security
Locate your Splunk Enterprise integration
Verify the connection status shows as Connected

Your Splunk Enterprise integration is now configured! RAD Security can query security data from Splunk for enrichment and correlation.

What Data Can Be Queried

RAD Security can query the following data types from Splunk:

Security Events

Firewall logs
IDS/IPS alerts
Web application firewall (WAF) events
Network traffic logs
VPN connection logs

Authentication & Access

Login attempts (successful and failed)
Authentication events from Active Directory, LDAP, etc.
Privilege escalation events
Account creation/modification/deletion
Session management events

Endpoint Data

EDR/antivirus alerts
Process execution logs
File system changes
Registry modifications (Windows)
System performance metrics

Cloud & Infrastructure

Cloud service logs (AWS CloudTrail, Azure Activity, GCP Audit)
Container runtime events
Kubernetes audit logs
Infrastructure changes
API access logs

Application Logs

Application errors and exceptions
API request/response logs
Database query logs
Custom application events
Performance metrics

Threat Intelligence

Indicator of Compromise (IoC) matches
Threat feeds integrated in Splunk
Malware detections
Command and control (C2) communications
Suspicious domain lookups

Use Cases

Security Event Enrichment

Enrich RAD Security runtime detections with historical context from Splunk logs.

Cross-Platform Correlation

Correlate RAD Security runtime events with network, endpoint, and application logs stored in Splunk.

Threat Investigation

Query Splunk for additional context when investigating security incidents detected by RAD Security.

Historical Analysis

Access historical security data from Splunk to establish baselines and identify anomalies.

IoC Validation

Validate indicators of compromise by querying Splunk’s threat intelligence and historical data.

Compliance Evidence

Pull compliance-relevant logs from Splunk to support RAD Security’s audit and compliance workflows.

Troubleshooting

Authentication Failed

Possible causes:

Token authentication not enabled in Splunk
Authentication token is incorrect or expired
Token was revoked
Service user account was disabled

Solution:

Verify token authentication is enabled: Settings > Authentication methods
Check token expiration date in Settings > Tokens
Ensure token is copied correctly (no extra spaces)
Verify the service user account is still active
Generate a new token if the old one was revoked or expired

Test authentication with curl:

curl -k https://<host>:8089/services/auth/login \
  -H "Authorization: Bearer <token>" \
  -d "output_mode=json"

Connection Failed

Possible causes:

Incorrect API endpoint URL or port
Firewall blocking port 8089
Splunk management port not accessible
SSL certificate issues

Solution:

Verify API URL format: https://<host>:8089
Ensure firewall rules allow port 8089 from RAD Security
Check Splunk is listening on port 8089: netstat -an | grep 8089
Test connectivity: telnet <host> 8089
Verify SSL certificate is valid
Whitelist RAD Security IP addresses if needed

Insufficient Permissions

Possible causes:

Service user lacks search role
No read access to required indexes
Custom role missing necessary capabilities
Index-level permissions not configured

Solution:

Verify service user has at minimum the user role
Check index permissions: Settings > Access controls > Roles
Ensure user can search the indexes you need: | eventcount summarize=false index=*
Test search directly in Splunk UI as the service user
Grant additional capabilities if needed (list_inputs, search, etc.)

Query Errors

Possible causes:

Using Splunk Cloud free trial (query API not available)
Invalid SPL (Search Processing Language) query
Query timeout
Search quota exceeded

Solution:

Verify you’re using Splunk Enterprise (query API not available in Cloud free trials)
Test queries directly in Splunk UI before using in RAD Security
Simplify complex queries or add time range restrictions
Check search job limits: Settings > Server settings > Search
Review Splunk search logs: index=_internal source=*splunkd.log* search

No Results Returned

Possible causes:

User doesn’t have access to the queried indexes
Time range doesn’t include relevant data
Query syntax is incorrect
Index doesn’t exist or is empty

Solution:

Verify the service user can access the target indexes
Check if data exists in the time range: Use Splunk UI to verify
Test with a simple query: index=_internal | head 10
Ensure the index name is spelled correctly
Check for typos in field names or values

Token Expired

Possible causes:

Token reached configured expiration time
Token was manually revoked
Service user password changed (doesn’t affect tokens but might be related)

Solution:

Check token status in Settings > Tokens
Create a new token following Step 3
Update the token in RAD Security integration settings
Consider setting longer expiration or implementing token rotation workflow
Document token expiration dates for proactive rotation

SSL/TLS Certificate Errors

Possible causes:

Self-signed certificate not trusted
Certificate validation failed
Certificate expired or hostname mismatch

Solution:

For testing: You may need to configure RAD Security to accept self-signed certificates
For production: Use valid SSL certificates from a trusted CA
Verify certificate expiration: openssl s_client -connect <host>:8089
Check hostname matches certificate CN or SAN
Import self-signed certificate to trusted store if needed

Rate Limiting or Quota Exceeded

Possible causes:

Too many concurrent searches
Search quota limits reached
API rate limiting enabled

Solution:

Check search concurrency limits: Settings > Server settings > Search
Review search quota usage for the service user
Reduce query frequency in RAD Security if possible
Increase search quotas for the service user if necessary
Schedule heavy queries during off-peak hours

Security Best Practices

Use Service Accounts

Always use a dedicated service account with a service email, never a personal account tied to an individual.

Rotate Tokens Regularly

Set token expiration periods and rotate before expiry. Recommended: 90 days or less.

Least Privilege Access

Grant only the minimum search permissions required. Use custom roles for granular access control.

Enable SSL/TLS

Always use HTTPS for the API endpoint. Use valid SSL certificates in production environments.

Monitor Token Usage

Regularly review authentication token usage in Splunk to detect anomalous query activity.

Restrict Network Access

Configure firewall rules to only allow port 8089 connections from RAD Security IP addresses.

Secure Token Storage

Store tokens in a secure password manager or secrets vault. Never commit tokens to version control.

Audit Search Activity

Regularly review search activity by the service user to ensure queries align with expected behavior.

Index-Level Permissions

Use index-level permissions to limit which data the service user can query.

Document Token Expiration

Maintain documentation of token expiration dates to enable proactive rotation.

Token Rotation

To rotate your Splunk authentication token:

Create New Token

Log in to Splunk Enterprise as admin
Navigate to Settings > Tokens
Create a new authentication token for the same service user
Use a different label to distinguish it from the old token

Update RAD Security Integration

Update the authentication token in RAD Security integration settings

Verify Connectivity

Test that queries still work with the new token

Revoke Old Token

Once verified, revoke the old token in Settings > Tokens

Token Rotation Schedule: Set calendar reminders 1-2 weeks before token expiration to ensure uninterrupted service.

Additional Resources

Authentication Tokens

Official Splunk guide to creating and managing authentication tokens

Splunk REST API

Complete reference for Splunk’s REST API

Search Reference

Splunk Search Processing Language (SPL) reference

User Access Control

Learn about Splunk users, roles, and permissions

Next Steps

SIEM Integrations Overview

Explore other SIEM integration options

Evidence Room

See how Splunk data enriches security findings

Runtime Security

Learn about RAD Security’s runtime detection capabilities

Data Sources

Connect additional security data sources

​Splunk Enterprise Integration Setup

​Prerequisites

​Step 1: Enable Token Authentication

​Step 2: Create Service User (Recommended)

​Step 3: Create Authentication Token

​Step 4: Configure in RAD Security

​Required Parameters

​Verify Integration

​What Data Can Be Queried

​Use Cases

Security Event Enrichment

Cross-Platform Correlation

Threat Investigation

Historical Analysis

IoC Validation

Compliance Evidence

​Troubleshooting

​Security Best Practices

Use Service Accounts

Rotate Tokens Regularly

Least Privilege Access

Enable SSL/TLS

Monitor Token Usage

Restrict Network Access

Secure Token Storage

Audit Search Activity

Index-Level Permissions

Document Token Expiration

​Token Rotation

​Additional Resources

Authentication Tokens

Splunk REST API

Search Reference

User Access Control

​Next Steps

SIEM Integrations Overview

Evidence Room

Runtime Security

Data Sources

Splunk Enterprise Integration Setup

Prerequisites

Step 1: Enable Token Authentication

Step 2: Create Service User (Recommended)

Step 3: Create Authentication Token

Step 4: Configure in RAD Security

Required Parameters

Verify Integration

What Data Can Be Queried

Use Cases

Troubleshooting

Security Best Practices

Token Rotation

Additional Resources

Next Steps