Set up an HTTP Event Collector input in Splunk

In Splunk Enterprise, go to Settings > Data Input > HTTP Event Collector.

Enter a Name to help identify the token receiving data over HTTP. Remember this name.

Select the New Token button at the top of the page.

Enter the fields and select Next.

Choose Select source type and specify contrast:adr for the source type.

Select the preferred index to store the data, likecontrast. If an index does not exist, create an index by following the steps on the relevant documentation page.

Select the Review button.

Select the Submit button.

Copy the token value on the success page. This will be needed for the integration in Configure Contrast Security ADR.

Copy the token value on the success page. This will be needed for the integration in Configure Contrast Security ADR.

Continue to Configure Contrast Security ADR.

Repeat steps 1 to 4 in the Set up an HTTP Event Collector input in Splunk for attack events section above.

In step 5, specify contrast:adr:incidents for the source type.

Repeat steps 6 to 9 in the Set up an HTTP Event Collector input in Splunk for attack events section above.

Continue to the next section.

Repeat steps 1 to 4 in the Set up an HTTP Event Collector input in Splunk for attack events section above.

In step 5, leave the source type as Automatic.

Repeat steps 6 to 9 in the Set up an HTTP Event Collector input in Splunk for attack events section above.

Continue to Configure Contrast Security ADR.