Adding Splunk Integrations

A Splunk integration forwards events from Veeam Data Cloud to a Splunk instance through the HTTP Event Collector (HEC). You can then search, correlate and visualize these events alongside other security data in your SIEM.

Before you add a Splunk integration, ensure that the HTTP Event Collector is enabled in your Splunk instance and that a HEC token has been generated. You need the HEC endpoint URL and the token value to complete the procedure. For details on HEC in Splunk Web, see Splunk Documentation.

To add a Splunk integration, do the following:

1. Click the settings icon in the top-right corner.
2. Select Integrations.
3. On the Integrations tab, click Add Integration.
4. In the Select Integration window, select Splunk and click Continue.
5. In the Connector Name field, specify a name for the integration.

6. In the Destination URL field, specify the HEC endpoint URL of your Splunk instance, for example, https://http-inputs-yourdomain.splunkcloud.com/services/collector/event.
7. In the Splunk HEC Token field, enter the HEC token generated in Splunk. The token is stored securely and masked when you view the integration later.
8. [Optional] In the Event Rules section, click Add Rules to define which event types and properties to forward and how to format them. If you do not add any rules, Veeam Data Cloud forwards raw events. For details on configuring event rules, see Configuring Event Rules.
9. To verify your settings, click Test Connection. Veeam Data Cloud will send a test event to the specified destination.
10. Click Add to save the integration.

If Veeam Data Cloud determines that credentials are present in the URL or a custom header, it will ask for your confirmation and prompt you to move them to the authentication section, where they will be stored securely.