Prisma Cloud Integration

[XOR]

Guys i have Splunk Cloud , i created Http Event Collector & in prisma i gave url /service/collector

but logs are not showing up in splunk .. my questions :  should i add port number after my http url ?

after url is it  /service/collector or /service/collector/events

what should i check as i tesed my prisma said tested pass

[livehybrid]

Hi @XOR 

You shouldnt need to add the port in the Prisma config as Splunk Cloud uses the default HTTPS port for HEC receiving. I assume the URL you used starts https:// ?

As far as I know there is no option to add an index into the Prisma configuration therefore the data will go into the default index you selected when you created the HEC token - Are you able to confirm that this is the index that you are checking in?

Regarding the  service/collector or /service/collector/events, you should be able to use the first, or "/services/collector/event" - note no "S" on the end. Prisma Cloud sends HEC events so this is the correct endpoint to use.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[XOR]

I tried this curl command and got this output

curl -k https://<splunkcloudlink>:8088/services/collector/event -H "Authorization: Splunk <hec token>" -d "{\"event\": \"hello from the other side\"}"

Output:
{"text":"Success","code":0}

what should i see next

[XOR]

One more question should I go to hec and copy paste that link right ... Can you pls give me example how that hec link should be like.

Eg my link look lke this https://splunkcloudname.com/httpcollector