Join the Conversation
- Find Answers
- :
- Splunk Products
- :
- Splunk Enterprise
- :
- Prisma Cloud integration
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Prisma Cloud integration
Has anyone integrated Prisma Cloud into Splunk Enterprise on AWS (either via SQS or API Gateway + Lambda + HEC) to view alert notifications from Prisma Cloud in Splunk?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
does the HEC url have to be hosted on Splunk cloud infrastructure to be accessible by Cloud Prisma ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@SimonO
Yes.I've used Splunk HEC token and configured it on Prisma to capture prisma alerts data to Splunk. If you want to go with HEC then use Splunk Integration option on Prisma .
But my recommendation would be, as the data is coming from cloud to on premesis you can place proper SSL cerificates to get this done work properly. I'd place certificate for HEC like this
splunk_httpinput/local/inputs.conf
[http]
disabled = 0
enableSSL = 1
serverCert = /opt/splunk/etc/auth/certs/prisma-cert.pem
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks, I have also tried using the HEC, but is gives me error "SSLCommon - Received fatal SSL3 alert. ssl_state='SSLv3 read client key exchange A', alert_description='certificate unknown'.
10-01-2020 00:05:38.336 +0100 WARN HttpListener - Socket error from XX.XX.XX.XX:11651 while idling: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown".
Although same certificate is working fine for Splunk Web.
Any help will be appreciated.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Announcing Modern Navigation: A New Era of Splunk User Experience
Modernize your Splunk Apps – Introducing Python 3.13 in Splunk
Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...
