topic Prisma Cloud integration in Splunk Enterprise

Prisma Cloud integration

SimonO — Tue, 16 Jun 2020 18:54:08 GMT

Has anyone integrated Prisma Cloud into Splunk Enterprise on AWS (either via SQS or API Gateway + Lambda + HEC) to view alert notifications from Prisma Cloud in Splunk?

https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/configure-external-integrations-on-prisma-cloud/integrate-prisma-cloud-with-amazon-sqs.html

https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/configure-external-integrations-on-prisma-cloud/integrate-prisma-cloud-with-splunk

Re: Prisma Cloud integration

muralikoppula — Tue, 16 Jun 2020 19:24:18 GMT

@SimonO
Yes.I've used Splunk HEC token and configured it on Prisma to capture prisma alerts data to Splunk. If you want to go with HEC then use Splunk Integration option on Prisma .

But my recommendation would be, as the data is coming from cloud to on premesis you can place proper SSL cerificates to get this done work properly. I'd place certificate for HEC like this

splunk_httpinput/local/inputs.conf
[http]
disabled = 0
enableSSL = 1
serverCert = /opt/splunk/etc/auth/certs/prisma-cert.pem

Re: Prisma Cloud integration

Priyankakumari1 — Thu, 01 Oct 2020 09:47:17 GMT

@muralikoppula

Thanks, I have also tried using the HEC, but is gives me error "SSLCommon - Received fatal SSL3 alert. ssl_state='SSLv3 read client key exchange A', alert_description='certificate unknown'.
10-01-2020 00:05:38.336 +0100 WARN HttpListener - Socket error from XX.XX.XX.XX:11651 while idling: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown".

Although same certificate is working fine for Splunk Web.

Any help will be appreciated.

Re: Prisma Cloud integration

sbsplunkuser — Thu, 22 Jul 2021 14:52:26 GMT

does the HEC url have to be hosted on Splunk cloud infrastructure to be accessible by Cloud Prisma ?