Splunk Cloud Platform

POST request out of Splunk Cloud to create an EnCase ticket

zshainsky
Splunk Employee
Splunk Employee

Hi All,

I am looking to send a POST request from Splunk Cloud to start an EnCase forensic investigation which is running on-prem. So far the two options I see are to use the Webhook Alert Action or to create a POST Workflow Action.

I have configured a POST Workflow Action, but I am not seeing any traffic coming from Splunk Cloud back to my Firewall. I have opened the ip and port inbound from the Splunk Cloud Search Head through my FW. I am not seeing anything in the _internal logs on the SH. Any troubleshooting steps I can take?

Has any one gotten this to work in Splunk Cloud? Any suggestions welcome!

Other things to consider:
- There is a HF set up on prem that could be used to communicate with Splunk Cloud and send the request on the internal network

Tags (1)
0 Karma

zshainsky
Splunk Employee
Splunk Employee

I am currently using HTTP to trigger the POST request. Does it need to be HTTPS from Splunk Cloud to EnCase? What port (443, 8089)?

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...