Ctrlk
For the complete documentation index, see llms.txt. This page is also available as Markdown.
Page cover

Splunk On-Prem SIEM / Vectra integration guide (start here for RUX)

Start here for Splunk integration with Vectra Respond UX, including supported add-ons/apps, install matrix, API client setup, and data inputs.

As stated in the summary, this article only applies to customers using Vectra's Respond UX. If you are using the Quadrant UX please see the Splunk Integration Guide for Vectra AI. If you are unsure of which UX you are using, please see Vectra Analyst User Experiences (Respond vs Quadrant).

Integration Overview

Vectra AI provides Add-ons and Apps to seamlessly integrate with Splunk and Splunk Enterprise Security. Vectra provides 2 main data sources for Splunk:

Detection Data and Entity Scoring from Vectra XDR

  • Vectra XDR uses a patent-pending combination of data science, machine learning and behavioral analysis to reveal the fundamental characteristics of malicious threat behavior. The Vectra platform captures packets and logs across public cloud, SaaS, federated identity and data center networks to surface and prioritize threats. These high-fidelity insights can be pulled via API to integrate seamlessly with your workflows and operations.

Network Metadata from Vectra Stream

  • Leveraging the same platform, Vectra provides the ability to export network metadata collected by the Vectra Sensors deployed through the environment to Splunk. This data provides an in-depth view of any communication observed in your environment and enables you to perform investigation & threat hunting. A list of protocols supported, and attributes extracted is available here.

Vectra XDR Add-On and Apps for Splunk

Vectra XDR

Name
Type
Supported Splunk Version
CIM Compatibility
Splunk Cloud
Data Structure

Vectra XDR Technology Add-on

Add-on

10.1, 10.0, 9.4, 9.3, 9.2

Yes

Yes

JSON

Vectra XDR App

App

10.1, 10.0, 9.4, 9.3, 9.2

n/a

Yes

n/a

Vectra Stream

Name
Type
Supported Splunk Version
CIM Compatibility
Splunk Cloud
Data structure
Dependencies

Technology Add-on for Vectra Stream (JSON)

Add-on

10.4, 10.3, 10.2, 10.1, 10.0, 9.4, 9.3, 9.2, 9.1

Yes

Yes

JSON

N/A

Vectra Stream

App

10.4, 10.3, 10.2, 10.1, 10.0, 9.4, 9.3, 9.2, 9.1, 9.0

n/a

Yes

n/a

Treemap

URL Toolbox

Prerequisites

  • Valid Splunk account to be able to access & download apps in Splunkbase.

  • Supported version of Splunk or Splunk Enterprise.

  • Applications dependencies listed in the Add-ons and apps table must be fulfilled.

  • Create index(es).

    • Vectra recommends to have a dedicated index for Vectra XDR and another dedicated index if also using Vectra Stream.

Integration of Splunk with Vectra XDR

There are 3 main steps required to integrate Splunk with Vectra XDR:

  1. Creating API clients in the Vectra Respond UX to be used by the Technology Add-on (TA).

  2. Installation and configuration of "Vectra XDR Technology Add-on".

    • The Vectra XDR Technology Add-on for Splunk pulls entity scoring data, detection data, audit data, lockdown data and health data from the Vectra platform, does CIM mapping on detection and audit data and maps the entity scoring, detection data fields to corresponding Vectra Syslog event fields.

    • If you have any prior version of a Vectra TA for use with an existing Quadrant UX based deployment of Vectra, you can keep that as a separate deployment but both the TA and App for Vectra XDR using the Respond UX must be installed separately. You cannot upgrade from a prior version to this version.

  3. Installation of "Vectra XDR App".

    • The Vectra XDR App for Splunk builds a dashboard from data provided by Vectra XDR Technology Add-on for Splunk.

1. Creating API Clients for Splunk Integration

Before configuring the Splunk integration, create separate API clients for each endpoint required by the integration.

Creating individual API clients for each endpoint is required to ensure that the Splunk integration can securely and efficiently collect data from Vectra.

Why Separate API Clients Are Required

Separate API clients are required for the following reasons:

  • Each endpoint used by the Splunk integration is polled individually.

  • Different endpoints require different permission levels in Vectra.

  • Using separate API clients helps improve performance and scalability when accessing multiple API endpoints.

  • Troubleshooting is easier because each API client is associated with a specific endpoint and purpose.

  • Access can be managed more securely by assigning only the required permissions to each API client.

API Clients Required for the Integration

Create the following API clients for use with the Vectra Splunk integration.

API Client Name
Role
Purpose

ro_splunk_entity_scoring

Read-only

Used by Splunk to poll the entity_scoring endpoint.

ro_splunk_detections

Read-only

Used by Splunk to poll the detections endpoint.

ro_splunk_lockdown

Read-only

Used by Splunk to poll the lockdown endpoint.

audit_splunk_audits

Auditor

Used by Splunk to poll the audits endpoint.

audit_splunk_health

Auditor

Used by Splunk to poll the health endpoint.

Recommended Naming Convention

Use clear and descriptive API client names so that each client can be easily identified during configuration and troubleshooting.

The recommended naming format is:

For example:

This name indicates that the API client is read-only, used for Splunk, and associated with the detections endpoint.

Permission Guidance

Assign only the permissions required for each endpoint.

  • Use a Read-only role for endpoints that only require read access.

  • Use an Auditor role for endpoints that require audit-level access.

  • Avoid using overly permissive roles unless specifically required.

This helps maintain least-privilege access for the Splunk integration.

Creating API Clients

To create each of the API clients listed above:

  • Log in to your Vectra Respond UX, navigate to Manage > API Clients, and click "Add API Client".

  • Enter a name for the client you are creating, select the role, optionally enter a description and then click "Generate Credentials".

  • On the "API Client Created" screen, copy the Client ID and Secret Key to a safe place for later configuration in Splunk and then click "Done".

    • !! Please note that this is the only time you can copy the secret key. If you do not copy the key now, you will need to delete your API client and start over creating that client.

  • When you have created all 5 required API clients, you screen should look similar to this:

After Creating the API Clients

After all required API clients are created:

  1. Save the client credentials securely.

  2. Confirm that each API client has the correct role assigned.

  3. Use these API clients when configuring accounts in the Vectra XDR Technology Add-on for Splunk.

  4. Create one account configuration for each API client in the add-on.

Once the API clients are created, continue with the add-on configuration steps in Splunk.

2. Installation and Configuration of "Vectra XDR Technology Add-on"

Installation of the Vectra XDR Technology Add-on for Splunk

This section explains how to install the Vectra XDR Technology Add-on for Splunk.

The add-on can be installed using one of the following methods:

  1. Recommended: Install the add-on from Find More Apps in Splunk Web.

  2. Alternative: Install the add-on from a downloaded file using Splunk Web.

  3. Manual Installation: Install the add-on directly from the Splunk server file system.

Use the installation methods in the order listed above. The Find More Apps method is recommended because it allows the add-on to be installed directly from Splunk Web with minimal manual steps.

Recommended Installation Order

Install the add-on using the following order of preference:

Priority
Installation Method
When to Use

1

Install from Find More Apps

Recommended method for most Splunk environments

2

Install from a file using Splunk Web

Use when you have already downloaded the add-on package

3

Manual installation from the file system

Use when Splunk Web installation is not available or not suitable

Method 1: Install the Add-on from Find More Apps

This is the recommended method for installing the Vectra XDR Technology Add-on for Splunk.

Use this method if the add-on is available from the Find More Apps section in Splunk Web.

Steps

  1. Log in to Splunk Web using an administrator account.

  2. From the Splunk home dashboard, go to the Apps section.

  3. Click Find More Apps.

  4. In the search bar, search for:

    Vectra XDR Technology Add-on

  5. Select the Vectra XDR Technology Add-on from the search results.

  6. Click Install.

  7. Follow the on-screen instructions to complete the installation.

  8. If Splunk prompts you to restart, restart the Splunk instance.

  9. After the restart is complete, log back in to Splunk Web.

  10. Navigate to:

Apps > Manage Apps

  1. Search for the Vectra XDR Technology Add-on and confirm that it is installed and enabled.

Method 2: Install the Add-on from a File Using Splunk Web

Use this method if the add-on package has already been downloaded and you want to upload it through Splunk Web.

Steps

  1. Download the Vectra XDR Technology Add-on package from Splunk.

  2. Log in to Splunk Web using an administrator account.

  3. From the Splunk home page, navigate to:

    Apps > Manage Apps

  4. In the upper-right corner of the page, click:

    Install app from file

  5. Click Choose File.

  6. Browse to the location where the Vectra XDR Technology Add-on installation file is saved.

  7. Select the add-on installation file.

  8. Click Upload.

  9. Follow the on-screen prompts to complete the installation.

  10. If Splunk prompts you to restart, restart the Splunk instance.

  11. After the restart is complete, verify that the add-on is installed by navigating to:

Apps > Manage Apps

  1. Search for the Vectra XDR Technology Add-on and confirm that it appears in the installed apps list.

Method 3: Manually Install the Add-on from the File System

Use this method only when installation through Splunk Web is not available or when your environment requires manual deployment.

Manual installation requires access to the Splunk server file system.

Steps

  1. Download the Vectra XDR Technology Add-on package.

  2. Log in to the Splunk server.

  3. Locate the downloaded add-on package.

  4. Extract the downloaded package directly into the Splunk apps directory:

  5. Confirm that the extracted add-on folder is available under:

  6. Ensure that the Splunk user has the correct ownership and permissions for the add-on directory.

  7. Restart Splunk to load the newly installed add-on:

  8. After Splunk restarts, log in to Splunk Web.

  9. Navigate to:

    Apps > Manage Apps

  10. Search for the Vectra XDR Technology Add-on and confirm that it is installed and enabled.

Verify the Installation

After completing any of the installation methods, verify that the add-on was installed successfully.

Steps

  1. Log in to Splunk Web.

  2. Navigate to:

    Apps > Manage Apps

  3. Search for:

    Vectra XDR Technology Add-on

  4. Confirm that the add-on appears in the list of installed apps.

  5. Verify that the add-on status is Enabled.

  6. If the add-on does not appear, restart Splunk and check again.

Configuration of the Add-on

After installing the Vectra XDR Technology Add-on, configure the required accounts, proxy settings, and logging level before creating data inputs.

The add-on configuration includes the following sections:

  • Account: Used to configure API client credentials.

  • Proxy: Used when Splunk must connect through a proxy server.

  • Logging: Used to define the logging level for troubleshooting and operational visibility.

Configure Accounts

Create an account for each API client that was configured earlier.

Steps

  1. Log in to Splunk Web.

  2. Navigate to:

    Vectra XDR Technology Add-on > Configuration > Account

  3. Click Add or Add Account.

  4. Enter the required account details for the API client.

  5. Save the account configuration.

  6. Repeat these steps for each API client that needs to be used with the add-on.

After the accounts are configured, the Account table should display the configured accounts.

Example Account Configuration:

Configure Proxy Settings

If your Splunk environment requires a proxy to connect to external services, configure the proxy settings in the add-on.

Skip this section if your Splunk environment does not use a proxy.

Steps

  1. Navigate to:

    Vectra XDR Technology Add-on > Configuration > Proxy

  2. Enable proxy configuration if required.

  3. Enter the required proxy details, such as:

    • Proxy host

    • Proxy port

    • Proxy username, if authentication is required

    • Proxy password, if authentication is required

  4. Save the proxy configuration.

Example Proxy Configuration:

Configure Logging Level

The logging level controls the amount of detail written to the add-on logs.

Steps

  1. Navigate to:

    Vectra XDR Technology Add-on > Configuration > Logging

  2. Select the desired logging level.

  3. Save the configuration.

If you are unsure which logging level to use, Vectra recommends selecting:

The Info logging level provides a balanced amount of operational detail and is suitable for most environments.

Recommended Logging Level

Logging Level
When to Use

Info

Recommended for normal operation.

Debug

Use temporarily when troubleshooting an issue.

Error

Use when you only want to capture error messages.

Note: Debug logging can generate more log data. Use it only when troubleshooting and change the logging level back to Info after the issue is resolved.

Verify the Add-on Configuration

After completing the configuration:

  1. Confirm that all required accounts are listed under the Account tab.

  2. Confirm that proxy settings are configured only if required by your Splunk environment.

  3. Confirm that the logging level is set to Info, unless a different level is needed.

  4. Continue to the data input configuration section.

Configuration of Data Inputs

After configuring the required account, create data inputs to collect data from the selected Vectra endpoints.

Create a separate data input for each account and endpoint that you want to ingest into Splunk. Each input should be configured with the correct name, interval, index, status, and account.

Add a New Data Input

  1. Log in to Splunk Web.

  2. Navigate to the Vectra XDR Technology Add-on.

  3. Go to the Inputs section.

  4. Click Create New Input or Add Input, depending on the option available in your Splunk interface.

  5. Configure the required fields for the data input.

Data Input Configuration Fields

Use the following guidance when configuring each data input.

Field
Description
Recommended Value

Name

Enter a unique name for the data input. The name should clearly relate to the account or endpoint being configured.

Use a descriptive name, such as detections_account1 or health_account1.

Interval

Defines how often Splunk collects data from the configured endpoint. The value is entered in seconds.

60 seconds is recommended for most inputs.

Index

Select the Splunk index where the collected data should be stored.

Use the index created for this add-on.

Historical Data

Optional setting that allows the input to collect data from the previous 24 hours when enabled.

Enable only if you want to backfill recent data.

Status

Determines whether the input is active.

Set to Enabled to start data collection.

Account

Select the account that was configured earlier.

Choose the appropriate account from the available list.

Recommended Input Interval

For most data inputs, an interval of 60 seconds is recommended.

This means Splunk checks the configured endpoint every 60 seconds and collects any available data.

Health Input Interval

For the Health input, use an interval of:

The Health input should use a longer interval because health data is refreshed every 15 minutes on the Vectra side. Setting the interval to 900 seconds helps avoid unnecessary polling and aligns the Splunk collection interval with the data refresh cycle.

Historical Data Option

The Historical Data option is optional.

When enabled, the input collects data from the previous 24 hours. This can be useful in smaller environments where you want to quickly verify that the add-on is working and confirm that data is being ingested into Splunk.

Use this option when you want immediate visibility into recent data after creating the input.

Important Notes

  • The Historical Data option is not available for the Health input.

  • The Historical Data option is not available for the Lockdown input.

  • Enabling historical data may increase the amount of data ingested during the first collection cycle.

Recommended Configuration

Use the following recommendations when creating data inputs:

Input Type
Recommended Interval
Historical Data Supported
Notes

Detections

60 seconds

Yes

Enable historical data if you want to collect the previous 24 hours of detection data.

Entities

60 seconds

Yes

Use the index created for the add-on.

Audits

60 seconds

Yes

Useful for collecting audit activity.

Health

900 seconds

No

Health data is refreshed every 15 minutes on the Vectra side.

Lockdown

60 seconds

No

Historical data is not available for Lockdown.

Verify Data Input Configuration

After creating the data inputs:

  1. Confirm that each required input appears in the Inputs table.

  2. Verify that the Status is set to Enabled.

  3. Confirm that each input is associated with the correct Account.

  4. Confirm that the correct Splunk Index is selected.

  5. Allow the configured interval to pass, then verify that data is being ingested into Splunk.

You can verify data ingestion by searching the configured index in Splunk Search.

Uninstall and Clean Up Steps

Use the following steps to uninstall the Vectra XDR Technology Add-on for Splunk and remove related log files from the Splunk instance.

Note: Before removing files, ensure that you have the required permissions on the Splunk server. If needed, take a backup of the add-on configuration before uninstalling.

Remove the Add-on Directory

Remove the add-on directory from the Splunk apps folder:

This removes the installed add-on files from the Splunk instance.

Remove Add-on Log Files

Remove the log files generated by the add-on from the Splunk log directory:

These log files are created by the add-on during configuration, data collection, and troubleshooting activities.

Restart Splunk

After removing the add-on directory and related log files, restart the Splunk Enterprise instance.

Restarting Splunk ensures that the cleanup changes are reflected in the Splunk Web UI.

After the restart is complete, verify that the add-on no longer appears under:

Troubleshooting

This section provides basic troubleshooting steps for the Vectra XDR Technology Add-on for Splunk.

Use these checks if the add-on is not working as expected, data is not being collected, or logs need to be reviewed.

General Checks

To troubleshoot the add-on, review the add-on log files located in the Splunk log directory:

All log files generated by this add-on are stored in this directory and use the following naming pattern:

You can also review the logs directly from Splunk Web using the following search query:

This query displays all log messages generated by the add-on.

To view only error messages, use the following query:

Review the error messages to identify configuration issues, authentication failures, connectivity problems, or data collection errors.

Add-on Icons Are Not Showing

The add-on does not require a Splunk restart immediately after installation for its core functionality to work.

However, the add-on icons may not appear in Splunk Web until Splunk is restarted once after installation.

If the icons are not visible:

  1. Restart the Splunk Enterprise instance.

  2. Log back in to Splunk Web.

  3. Navigate to the Apps menu and verify that the add-on icons are displayed.

Data Collection Issues

If data collection is not working, verify the following:

  1. Confirm that the Splunk server has internet connectivity.

  2. If your environment uses a proxy, confirm that the proxy is enabled and configured correctly in the add-on.

  3. Confirm that the configured account credentials are correct.

  4. Verify that the data inputs are enabled.

  5. Confirm that the selected index exists and is searchable.

  6. Review the relevant input log files for error messages.

Input-Specific Log Files

Each data input writes logs to a specific log file. Use the log file that matches the input type you are troubleshooting.

Input Type
Log File

Entity Scoring

ta_vectra_xdr_entity_scoring_input_<input_name>.log

Detections

ta_vectra_xdr_detections_input_<input_name>.log

Audits

ta_vectra_xdr_audits_input_<input_name>.log

Lockdown

ta_vectra_xdr_lockdown_input_<input_name>.log

Health

ta_vectra_xdr_health_input_<input_name>.log

Replace <input_name> with the name of the data input configured in Splunk.

Example Troubleshooting Searches

Use the following Splunk searches to review add-on activity.

View All Add-on Logs

View Add-on Errors

View Logs for a Specific Input

Replace <input_name> with the name of the input you want to troubleshoot.

Recommended Troubleshooting Flow

Use the following order when troubleshooting data collection issues:

  1. Confirm that the data input is enabled.

  2. Confirm that the account configuration is correct.

  3. Confirm that the index is configured correctly.

  4. Check network connectivity from the Splunk server.

  5. Verify proxy configuration, if a proxy is required.

  6. Review the add-on logs in:

  7. Search the _internal index for add-on errors.

  8. Resolve any errors found in the logs and restart Splunk if required.

3. Installation of Vectra XDR App for Splunk

This section explains how to install, configure, troubleshoot, and uninstall the Vectra XDR App for Splunk.

The Vectra XDR App provides dashboards and visualizations for data collected by the Vectra XDR Technology Add-on for Splunk. Before using the app, ensure that the add-on is installed, configured, and collecting data successfully.

Installation

The Vectra XDR App for Splunk can be installed using one of the following methods:

  1. Recommended: Install the app from Find More Apps in Splunk Web.

  2. Alternative: Install the app from a downloaded file using Splunk Web.

Method 1: Install from Find More Apps

Use this method if the app is available directly from Splunk Web.

Steps

  1. Log in to Splunk Web using an administrator account.

  2. From the Splunk Home dashboard, go to the Apps section.

  3. Click Find More Apps.

  4. Search for:

    Vectra XDR App for Splunk

  5. Select the app from the search results.

  6. Click Install.

  7. Follow the on-screen instructions to complete the installation.

  8. Restart Splunk if prompted.

  9. After installation, verify that the app is available from the Splunk Apps menu.

Method 2: Install from a File Using Splunk Web

Use this method if you have already downloaded the app package.

Steps

  1. Download the Vectra XDR App for Splunk package from Splunk.

  2. Log in to Splunk Web using an administrator account.

  3. Navigate to:

    Apps > Manage Apps

  4. In the upper-right corner, click:

    Install app from file

  5. Click Choose File.

  6. Select the downloaded Vectra XDR App package.

  7. Click Upload.

  8. Follow the on-screen prompts to complete the installation.

  9. Restart Splunk if prompted.

  10. After installation, confirm that the app appears in the Splunk Apps menu.

Configuration

No additional configuration is required if the data collected by the add-on is stored in the default Splunk index:

However, if you configured the data inputs to send data to an index other than main, you must update the app macro so that the dashboards search the correct index.

Update the Index Macro

Update the index macro only if your data is stored in a custom index.

Steps

  1. Log in to Splunk Web.

  2. Navigate to:

    Settings > Advanced search > Search macros

  3. In the App context drop-down, select:

    Vectra XDR App for Splunk

  4. Locate and open the following macro:

  5. Update the macro definition to use the index configured for the Vectra XDR Technology Add-on.

    Example:

  6. Click Save.

  7. Open the Vectra XDR App dashboards and confirm that data is displayed.

Configuration Example

If your Vectra data is stored in an index named vectra_index, update the macro definition as follows:

This ensures that the app dashboards search the correct index instead of the default main index.

Troubleshooting

Use this section if dashboards are not displaying data or if you need to verify that Vectra data is available in Splunk.

Verify Data in the Configured Index

To confirm that data is being collected, run a search using the index configured for the add-on.

Example:

Replace <your_index_name> with the index used in your data input configuration.

Search by Individual Sourcetype

You can also search each sourcetype individually.

Lockdown Events

Audit Events

Detection Events

Entity Scoring Events

Health Events

Review Add-on Logs

The Vectra XDR App uses data collected by the Vectra XDR Technology Add-on. If data is not available, review the add-on logs.

The add-on log files are located in:

Check log files that match the following pattern:

You can also search the logs from Splunk Web:

To view only error messages, use:

Dashboard Is Not Populating

If the Vectra XDR App dashboards are not displaying data, verify the following:

  1. Confirm that the Vectra XDR Technology Add-on is installed and collecting data.

  2. Confirm that the data inputs are enabled.

  3. Confirm that data exists in the configured index.

  4. Confirm that the expected sourcetypes are available in Splunk.

  5. If you are using a custom index, confirm that the vectra_xdr_index_macro macro is updated correctly.

  6. Refresh the dashboard after updating the macro.

  7. If required, restart Splunk and check the dashboard again.

Uninstall and Clean Up Steps

Use the following steps to uninstall the Vectra XDR App for Splunk.

Note: Removing the app does not remove the data already indexed in Splunk. It only removes the app files, dashboards, and related app components.

Remove the App Directory

Remove the app directory from the Splunk apps folder:

Restart Splunk

After removing the app directory, restart the Splunk Enterprise instance so that the cleanup changes are reflected in Splunk Web.

Verify Uninstallation

After Splunk restarts:

  1. Log in to Splunk Web.

  2. Navigate to:

    Apps > Manage Apps

  3. Confirm that Vectra XDR App for Splunk no longer appears in the installed apps list.

Integration of Splunk with Vectra Stream

There are 3 main steps required to integrate Splunk with Vectra Stream:

  1. Installation and configuration of "Technology Add-on for Vectra Stream (JSON) ".

  2. Installation of "Vectra Stream " App.

  3. Configuring Vectra Stream to send metadata to Splunk using Publisher of "Raw JSON" using Protocol of "TCP" to the server IP/Hostname and port number of your choice where Splunk will be listening.

For details please see the Splunk Integration Guide for Vectra AI .

PreviousQRadar SIEM Integration (QUX)NextSplunk Cloud SIEM / Vectra integration guide (start here for RUX)

Last updated

Was this helpful?