Prisma Cloud integration

[SimonO]

Has anyone integrated Prisma Cloud into Splunk Enterprise on AWS (either via SQS or API Gateway + Lambda + HEC) to view alert notifications from Prisma Cloud in Splunk?

https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/configure-external-integrat...

https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin/configure-external-integrat...

[sbsplunkuser]

does the HEC url have to be hosted on Splunk cloud infrastructure to be accessible by Cloud Prisma ? 

[muralikoppula]

@SimonO
Yes.I've used Splunk HEC token and configured it on Prisma to capture prisma alerts data to Splunk. If you want to go with HEC then use Splunk Integration option on Prisma .

But my recommendation would be, as the data is coming from cloud to on premesis you can place proper SSL cerificates to get this done work properly. I'd place certificate for HEC like this

splunk_httpinput/local/inputs.conf
[http]
disabled = 0
enableSSL = 1
serverCert = /opt/splunk/etc/auth/certs/prisma-cert.pem

[Priyankakumari1]

@muralikoppula 

Thanks, I have also tried using the HEC, but is gives me error "SSLCommon - Received fatal SSL3 alert. ssl_state='SSLv3 read client key exchange A', alert_description='certificate unknown'.
10-01-2020 00:05:38.336 +0100 WARN HttpListener - Socket error from XX.XX.XX.XX:11651 while idling: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown".

Although same certificate is working fine for Splunk Web.

Any help will be appreciated.