Getting Data In

Help needed on HEC tokens

Path Finder

Hello Team, 

We need to integrate the puppet integration with splunk for the security related events are pushed to our Splunk SIEM. is this good to use HEC tokens for this ? or syslog is fine ? 


Labels (1)
0 Karma


Each option has its pros and cons. In the end it usually comes down to what your source can do.

syslog is usually lighter and easier to configure on the source side and much easier to come by as implemented in various solutions but usually needs some overhead on the receiving side to make sense of it.

Sending events to HEC can be more reliable and you can - for example - set up mutual authentication between sender and receiver but is more complicated to implement so it's not very often used.

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...