Splunk Cloud Platform

POST request out of Splunk Cloud to create an EnCase ticket

zshainsky
Splunk Employee
Splunk Employee

Hi All,

I am looking to send a POST request from Splunk Cloud to start an EnCase forensic investigation which is running on-prem. So far the two options I see are to use the Webhook Alert Action or to create a POST Workflow Action.

I have configured a POST Workflow Action, but I am not seeing any traffic coming from Splunk Cloud back to my Firewall. I have opened the ip and port inbound from the Splunk Cloud Search Head through my FW. I am not seeing anything in the _internal logs on the SH. Any troubleshooting steps I can take?

Has any one gotten this to work in Splunk Cloud? Any suggestions welcome!

Other things to consider:
- There is a HF set up on prem that could be used to communicate with Splunk Cloud and send the request on the internal network

Tags (1)
0 Karma

zshainsky
Splunk Employee
Splunk Employee

I am currently using HTTP to trigger the POST request. Does it need to be HTTPS from Splunk Cloud to EnCase? What port (443, 8089)?

0 Karma
Get Updates on the Splunk Community!

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...

Want a chance to win $500 to the Splunk shop? Take our IT Incident Management Survey!

  Top Trends & Best Practices in Incident ManagementSplunk is partnering up with Constellation Research to ...