Splunk Enterprise

Prisma Cloud integration

New Member

Has anyone integrated Prisma Cloud into Splunk Enterprise on AWS (either via SQS or API Gateway + Lambda + HEC) to view alert notifications from Prisma Cloud in Splunk?





Labels (1)
Tags (3)
0 Karma

New Member

does the HEC url have to be hosted on Splunk cloud infrastructure to be accessible by Cloud Prisma ? 

0 Karma


Yes.I've used Splunk HEC token and configured it on Prisma to capture prisma alerts data to Splunk. If you want to go with HEC then use Splunk Integration option on Prisma .

But my recommendation would be, as the data is coming from cloud to on premesis you can place proper SSL cerificates to get this done work properly. I'd place certificate for HEC like this

disabled = 0
enableSSL = 1
serverCert = /opt/splunk/etc/auth/certs/prisma-cert.pem

0 Karma



Thanks, I have also tried using the HEC, but is gives me error "SSLCommon - Received fatal SSL3 alert. ssl_state='SSLv3 read client key exchange A', alert_description='certificate unknown'.
10-01-2020 00:05:38.336 +0100 WARN HttpListener - Socket error from XX.XX.XX.XX:11651 while idling: error:14094416:SSL routines:ssl3_read_bytes:sslv3 alert certificate unknown".

Although same certificate is working fine for Splunk Web.

Any help will be appreciated.



0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...