Integrate Reveal(x) 360 with Splunk
This integration enables you to view network threat detections and behavioral insights from Reveal(x) 360 in Splunk.
To configure this integration, you must create Splunk integration credentials and then add them to the configuration of the ExtraHop Add-On for Splunk.
ExtraHop Reveal(x) 360
- Your user account must have privileges on Reveal(x) 360 for System and Access Administration.
- Your Reveal(x) 360 system must be connected to an ExtraHop sensor with firmware version 8.8 or later.
- Your Reveal(x) 360 system must be connected to ExtraHop Cloud Services.
Create Splunk integration credentials
- Log in to Reveal(x) 360.
- Click the System Settings icon and then click Integrations.
- Click the Splunk tile.
Click Create Credential.
The page displays the generated ID and secret.
- Copy and store the ID and secret, which you will need to configure the ExtraHop Add-On for Splunk.
- Click Done.
The credential is also added to the ExtraHop REST API Credentials page where you can view the credential status, copy the ID, or delete the credential.
Install and configure the ExtraHop Add-On for Splunk
- Download the ExtraHop Add-On for Splunk from the SplunkBase site.
- Install and configure the add-on according to the following documentation:
In the following configuration fields, enter the credentials
you created and copied for the Splunk integration:
- Client ID
- Client Secret
Next stepsExport Reveal(x) 360 detections and metrics and view them in Splunk according to the instructions in the ExtraHop Add-On for Splunk Details.
Thank you for your feedback. Can we contact you to ask follow up questions?