topic Re: Beyond Trust Remote Support SaaS integration with Splunk in Splunk Cloud Platform

Beyond Trust Remote Support SaaS integration with Splunk

mohsplunking — Fri, 14 Feb 2025 09:43:21 GMT

Hello Splunkers,

Checking if anyone has successfully integrated Beyond Trust RS SaaS with Splunk , their official guide only talks about on-prem integration where a Middleware connector needs to be installed, but for Cloud Remote Support application how this can be achieved , is there a Custom TA for REST or a HEC can be used here.

Appreciate some assistance here,

Thanks!

regards,

Moh.

Re: Beyond Trust Remote Support SaaS integration with Splunk

kiran_panchavat — Fri, 14 Feb 2025 12:47:40 GMT

@mohsplunking

Refer to this documentation, where they have specified integration using an HEC token. You can use Splunk's HTTP Event Collector to forward data from BeyondTrust to Splunk. This method involves creating an HTTP Event Collector in Splunk and configuring BeyondTrust to send events to this collector

https://docs.beyondtrust.com/insights/docs/splunk

Splunk

Re: Beyond Trust Remote Support SaaS integration with Splunk

mohsplunking — Mon, 03 Mar 2025 16:07:17 GMT

Thanks for your inputs here Kiran, however, it does look like that integration guide is for Beyond Trust Remote Support integration 😞

regards,

Mohammed.

Re: Beyond Trust Remote Support SaaS integration with Splunk

kiran_panchavat — Mon, 03 Mar 2025 16:54:55 GMT

@mohsplunking

Since BeyondTrust Remote Support SaaS is a cloud offering, the integration likely relies on its API capabilities or syslog forwarding features that can be directed to Splunk Cloud.

HEC

Splunk Cloud supports HEC, which allows you to send data over HTTPS using a token-based authentication method. If BeyondTrust Remote Support SaaS can send event data (e.g., session logs) to a custom endpoint, HEC could ingest this data directly.

Custom TA for REST API

Check BeyondTrust’s documentation or contact their support to confirm the availability of a REST API for the SaaS version.

Build a Custom TA.

Install the “REST API Modular Input” app from Splunkbase (if supported in your Splunk Cloud environment; you may need to request Splunk Support to install it).

Configure a REST input with the BeyondTrust API URL, authentication (OAuth or API key), and polling interval (e.g., every 60 seconds).

Write props.conf and transforms.conf in the TA to parse the API response (likely JSON) into meaningful fields for Splunk.

Syslog Forwarding with an Intermediary

In the BeyondTrust admin interface, set up syslog forwarding to a server you control (e.g., IP address and port like 514 for UDP or TCP.

Deploy a Splunk Universal Forwarder on a small VM or container. Configure it to listen for syslog data and forward it to Splunk Cloud using outputs.conf.