How do I forward events and incidents from Entuity to Splunk?

To set up the Entuity app with Splunk, and to view the Event Dashboard in Splunk

To set up the Splunk configuration file

EMS actions that forward events and incidents to Splunk

To forward events to Splunk

To forward incidents to Splunk

To set up the Entuity app with Splunk, and to view the Event Dashboard in Splunk:

1. On the Splunk Enterprise page, click Install app from file in the top-right of the window, which will open the Upload app page. 
2. Browse and select the Entuity app file, and click Upload.
3. Once the Entuity app has been uploaded, click the Apps dropdown field at the top of the page, and select Entuity App. This will open the Entuity app.
4. Click the Dashboards tab at the top of the window to open the Dashboards page. 
5. Click Event Dashboard to open the dashboard, which will be empty until you have configured Entuity to forward events to Splunk.

To set up the Splunk configuration file:

1. Navigate to the Splunk-example.cfg file, located in the entuity_home/etc directory.
2. Using this example, create a Splunk.cfg file, and save it to the same entuity_home/etc directory.
3. Update the 'default' section or add a named 'section' to the file, and specify values for the host, port and path, which together comprise the URL for the Splunk HttpEventCollector.

4. Optionally set the protocol in the proto field, and choose whether to enable or disable certificate testing via the trust field.

   The default trust value is 1, which enables certificate testing. If you are using the cloud version of Splunk, enter 0 to disable checking of the certificate.
   For example:

   [default]
   port=8088
   proto=https
   trust=1
   host=localhost
   path=/services/collector/event

5. Save the file, and then stop and restart Entuity.

Note, you can enter the value of the 'section' name (default in this example) in the cname parameter later when you configure Entuity to forward events and incidents.

EMS actions that forward events and incidents to Splunk

As of Entuity v23.0 P01 upwards, there are two EMS actions for forwarding events and incidents to Splunk: 'Send to Splunk' and 'Send to Splunk Queue'

The 'Send to Splunk' action forwards each event and incident directly to Splunk, while the 'Send to Splunk Queue' action forwards events and incidents to Splunk through a queue from the Message Broker. Sending through a queue helps prevent communication or connection errors during the forwarding process, as messages remain in the queue until successfully acknowledged by the target endpoint. A message queue log file is also created when using the 'Send to Splunk Queue' action. For more information on message queues, see this article.

For information about EMS actions, see What are EMS actions?

To forward events to Splunk:

You can forward events to Splunk (via the HttpEventCollector in Splunk) by setting up an event rule in Entuity. This rule is also used by the Events Dashboard in Splunk.

1. In Splunk, follow the instructions provided by the Splunk documentation to generate an HttpEventCollector. 
   Ensure the sourceType is 'Entuity_Events'. Also, ensure that, in Global Settings, the token is set to Enabled.
2. In Entuity, click Main Menu and then Administration.
3. On the Administration page, click Event Administration.
4. On the Event Administration page, click the Rules tab.
5. Select Post Storage in the tree on the left, and then click Add Rule at the bottom of the window.
   
   
6. From the Add Rule window that is opened, ensure that the Type field is set to 'Generic', and the enabled checkbox is selected.
7. Complete the Name and Description fields, as appropriate.
8. Leave the Condition field as 'None'.
9. In the Action Steps section, click Add to open the Add Action window.
   1. In the Type dropdown field, select 'Send to Splunk', or, from Entuity v23.0 P01 upwards, 'Send to Splunk Queue'. 
   2. In the Parameters field, select the 'cname' parameter and click Set to open the Parameter Value window. 
   3. Enter the value of the 'cname' parameter in the Value field, which is defined in the Splunk configuration file, such as 'default'. Then click OK.
   4. In the Parameters field, select the 'token' parameter and click Set.
   5. In the Value field, enter the Splunk HttpEventCollector token, and click OK.
   6. Click OK to save the action step and return to the Add Rule window.
10. Click OK to save and add the event rule, and then click the Save icon in the top-right of the Event Administration page to save the event project.

11. If you selected the 'Send to Splunk Queue' action step in step i (Entuity v23.0 P01 upwards), choose whether to execute callback actions by optionally using the 'Response Callback' action. Do one of the following:

    • If you want a 'Response Callback' action executed when event and incident data is sent to the Splunk integration:
      1. Keep the 'callback' parameter in the 'Send to Splunk Queue' action step.
      2. Create a Splunk-specific 'Response Callback' action from the Actions tab of the Event Administration page, and define which action to execute upon receiving a response from the Splunk integration.
      3. Return to the 'Send to Splunk Queue' action step in the new rule from the Rules tab (for events) or in the new trigger from the Incidents tab (for incidents) on the Event Administration page.
      4. Enter the name of the newly created 'Response Callback' action as the value of the action step 'callback' parameter.
    • If no 'Response Callback' action is required, go to the Actions tab of the Event Administration page, and remove the 'callback' parameter from the 'Send to Splunk Queue' action.

    
    Note, if events are forwarded through message queues, the 'Set Attribute' option can't be used as a 'Response Callback' action. However, you can use other options in the 'Response Callback' action, such as 'Create Event'..

To forward incidents to Splunk:

You can forward incidents to Splunk (via the HttpEventCollector in Splunk) by setting up an event trigger. You can configure a global trigger so that all incidents will be forwarded to a server, or individual triggers so that only individual incidents will be forwarded.

1.  In Splunk, follow the instructions provided by the Splunk documentation to generate an HttpEventCollector in Splunk. 
2. In Entuity, click Main Menu and then Administration.
3. On the Administration page, click Event Administration.
4. On the Event Administration page, click the Incidents tab,
5. Click Edit Global Triggers at the bottom of the window.
6. This will open the Edit Global Triggers window. Click Add. 
7. This will open the Create Trigger window. Complete the Name and Description fields, as appropriate, and ensure that the enabled checkbox is selected.
8. Ensure that the On Transition To dropdown field is set to 'Any Change' so that all incidents raised against the same source are sent to Splunk.
9. In the Condition dropdown field, select 'All tests must succeed' which will update the window.
   1. In the Tests section, click Add to open the Add Test window.
   2. In the Type dropdown field, select 'Incident Severity Test'.
   3. In the Expression dropdown field, specify the severity level you want to forward.
   4. Click OK to return to the Edit Trigger window.
10. In the Action Steps section, click Add to open the Add Action window. 
    1. In the Type dropdown field, select 'Send to Splunk' or, from Entuity v23.0 P01 upwards, 'Send to Splunk Queue'.
    2. In the Parameters field, select the 'cname' parameter and click Set.
       1. Enter the value of the 'cname' parameter in the Value field which is defined in the Splunk configuration file, such as 'default'. Then click OK to return to the Add Action window.
    3. In the Parameters field, select the 'token' parameter and click Set.
       1. Set the Value field to the Splunk HttpEventCollector token, and click OK.
    4. Click OK to save and return to the Create Trigger window.
11. Click OK to save and add the trigger, and then click the Save icon in the top-right of the Event Administration page to save the event project.
12. If you selected 'Send to Splunk' in step i, choose whether to execute callback actions, in the same way as step 11 for the event process.

If you want to differentiate between when an incident is opened, closed and expired, you can set up multiple forwarding actions with different On Transition To field values (step 8 above). Ensure each HttpEventCollector has a different sourceType, so they can be differentiated on Splunk.