https://community.splunk.com/t5/Dashboards-Visualizations/How-to-get-ExtraHop-ML-security-detections-into-Splunk/m-p/476163#M45852 <P>I would like to create a dashboard in Splunk on my ExtraHop ML security detections. How do I do this?</P> Wed, 19 Feb 2020 00:40:43 GMT canalesjac 2020-02-19T00:40:43Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-get-ExtraHop-ML-security-detections-into-Splunk/m-p/476163#M45852 <P>I would like to create a dashboard in Splunk on my ExtraHop ML security detections. How do I do this?</P> Wed, 19 Feb 2020 00:40:43 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-get-ExtraHop-ML-security-detections-into-Splunk/m-p/476163#M45852 canalesjac 2020-02-19T00:40:43Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-get-ExtraHop-ML-security-detections-into-Splunk/m-p/476164#M45853 <P>I found the answer to my question. ExtraHop Reveal(x) can send data to Splunk as a SIEM Syslog target. You can create a ExtraHop ML Detection Trigger and send it to your Splunk target. You can configure a Syslog input and create an ExtraHop index on port 514. You can then create custom dashboards. I recommend using Splunk universal forwarder dedicated for your Syslog input. You can find more information and an example the ExtraHop forum.</P> <P><IMG src="http://bit.ly/2vDn5lB" alt="ExtraHop Forum Article" /><A href="http://bit.ly/2vDn5lB">http://bit.ly/2vDn5lB</A></P> <P><span class="lia-inline-image-display-wrapper"><img src="https://community.splunk.com/t5/image/serverpage/image-id/8427i5C383176BDD34619/image-size/large?v=v2&amp;px=999" title="ExtraHop Dashboard" alt="ExtraHop Dashboard" /></span></P> Wed, 19 Feb 2020 06:43:27 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-get-ExtraHop-ML-security-detections-into-Splunk/m-p/476164#M45853 canalesjac 2020-02-19T06:43:27Z