Splunk HEC

Setup

1. Create an HEC token

Splunk → Settings → Data inputs → HTTP Event Collector → New Token:

• Name: tappass
• Source type: tappass:cef (CEF) or tappass:audit (JSON)
• Index: security (or per-env)

Note the HEC token.

2. Configure TapPass

Via environment:

TAPPASS_SIEM_URL=https://splunk.example.com:8088/services/collector
TAPPASS_SIEM_DESTINATION=splunk_hec
TAPPASS_SIEM_AUTH_TOKEN=<hec-token>

Or via the settings API:

curl -X PUT https://tappass.example.com/api/settings/siem \
  -H "Authorization: Bearer $ADMIN_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "enabled": true,
    "destination": "splunk_hec",
    "url": "https://splunk.example.com:8088/services/collector",
    "auth_token": "<hec-token>",
    "format": "cef",
    "severity_filter": "detection"
  }'

3. Validate

curl -X POST https://tappass.example.com/api/settings/siem/test \
  -H "Authorization: Bearer $ADMIN_KEY"

Sends a test event. If Splunk is reachable and the token is valid, it shows up in the configured index within seconds. GET /api/settings/siem/stats shows delivered/failed counts.

CEF example

CEF:0|TapPass|Governance|...|detection.pii|PII detected|4|...

Splunk parses CEF natively — each KVP becomes an indexed field. Use format: "json" for raw TapPass JSON instead.

Filtering

Keep licence cost down by exporting only what matters — set severity_filter to detection, action, or block (default detection; all exports everything), and use event_types / exclude_event_types lists for finer control.

PII redaction

Redaction is automatic: API keys, bearer tokens, connection strings, and absolute file paths are stripped from events before export, and large content fields are truncated. No configuration needed.

Troubleshooting

Symptom	Fix
401/403 on every send	HEC token wrong or disabled
Events missing	Index permissions — HEC token must have write on that index; check GET /api/settings/siem/stats for failures