Search Alerts - Securing SNS / Webhook alerts?

New Member

We would like to bubble up alerts from Splunk to our alert management platform.

I see there are a couple of options,   AWS SNS Topics, and a Webhook Alert.

With either of those there is a security issue, as it would require  us to open an API or SNS Topic to the world.

What I would like is in the case of SNS,  to know if there is an AWS Account or IP that I could restrict ingress?    For the webhook I guess it could only be an IP restriction from the splunk hosts.

Also - if there is a better option / add-on available to increase security here I would be interested.  I just haven't found anything other than "Observability Cloud" which we do not have a license for. 


Labels (1)
0 Karma
Get Updates on the Splunk Community!

There's No Place Like Chrome and the Splunk Platform

Watch On DemandMalware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

The Great Resilience Quest: 5th Leaderboard Update

The fifth leaderboard update for The Great Resilience Quest is out >> 🏆 Check out the ...

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...