Skip to content

Splunk Enterprise via Fluentd

These instructions provide you with the example integration of Wallarm with the Fluentd log collector to further forward events to the Splunk SIEM system.

Webhooks can be used as system log sources. The number of log sources depends on the system complexity: the more components in the system, the greater number of log sources and logs. The most common logging scheme in complex systems consists of the following components:

  • Log collector: accepts logs from several sources and forwards logs to the SIEM system

  • SIEM system: used to analyze logs and monitor the system status

Webhook flow

Used resources

Wallarm Cloud IP addresses

To provide Wallarm Cloud access to your system, you may need a list of its public IP addresses. To get these addresses, request them from the Wallarm technical support team.

Note that the public IP addresses of Wallarm Cloud can change from time to time. If your experience some problems with the addresses that you currently use, request up-to-date addresses from the Wallarm technical support team.

Since the links to the Splunk Enterprise and Fluentd services are cited as examples, they do not respond.

Splunk Enterprise configuration

Fluentd logs are sent to Splunk HTTP Event Controller with the name Wallarm Fluentd logs and other default settings:

HTTP Event Collector Configuration

To access the HTTP Event Controller, the generated token f44b3179-91aa-44f5-a6f7-202265e10475 will be used.

A more detailed description of Splunk HTTP Event Controller setup is available in the official Splunk documentation.

Fluentd configuration

Fluentd is configured in the td-agent.conf file:

  • Incoming webhook processing is configured in the source directive:

    • Traffic is sent to port 9880
    • Fluentd is configured to accept only HTTPS connections
    • Fluentd TLS certificate signed by a publicly trusted CA is located within the file /etc/ssl/certs/fluentd.crt
    • Private key for TLS certificate is located within the file /etc/ssl/private/fluentd.key
  • Forwarding logs to Splunk and log output are configured in the match directive:

    • All event logs are copied from Fluentd and forwarded to Splunk HTTP Event Controller via the output plugin fluent-plugin-splunk-hec
    • Fluentd logs are additionally printed on the command line in JSON format (19-22 code lines). The setting is used to verify that events are logged via Fluentd
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
<source>
  @type http # input plugin for HTTP and HTTPS traffic
  port 9880 # port for incoming requests
  <transport tls> # configuration for connections handling
    cert_path /etc/ssl/certs/fluentd.crt
    private_key_path /etc/ssl/private/fluentd.key
  </transport>
</source>
<match **>
  @type copy
  <store>
      @type splunk_hec # output plugin fluent-plugin-splunk-hec to forward logs to Splunk API via HTTP Event Controller
      hec_host 109.111.35.11 # Splunk host
      hec_port 8088 # Splunk API port
      hec_token f44b3179-91aa-44f5-a6f7-202265e10475 # HTTP Event Controller token
    <format>
      @type json # format of forwarded logs
    </format>
  </store>
  <store>
     @type stdout # output plugin to print Fluentd logs on the command line
     output_type json # format of logs printed on the command line
  </store>
</match>

A more detailed description of configuration files is available in the official Fluentd documentation.

Testing Fluentd configuration

To check that Fluentd logs are created and forwarded to Splunk, the PUT or POST request can be sent to Fluentd.

Request example:

curl -X POST 'https://fluentd-example-domain.com' -H "Content-Type: application/json" -H "Authorization: Splunk f44b3179-91aa-44f5-a6f7-202265e10475" -d '{"key1":"value1", "key2":"value2"}'

Fluentd logs:

Logs in Fluentd

Splunk logs:

Logs in Splunk

Configuration of webhook integration

  • Webhooks are sent to https://fluentd-example-domain.com

  • Webhooks are sent via POST requests

  • The webhook integration has default advanced settings

  • Webhooks sent to Webhook URLs are all available events: hits, system events, vulnerabilities, scope changes

Webhook integration with Fluentd

More details on the webhook integration configuration

Example testing

To test the configuration, a new user is added in Wallarm Console:

Adding user

Fluentd will log the event as follows:

Log about new user in Splunk from Fluentd

The following entry will be displayed in Splunk events:

New user card in Splunk from Fluentd