Splunk and Illumio Insights Agent

This section covers configuring the Illumio Insights Splunk Cloud integration, viewing exported findings in Splunk, and understanding the JSON event structure that Illumio sends.

Send Insights Agent Findings to Splunk Cloud

This integration lets organizations export Illumio Insights findings from their environment to Splunk as structured JSON events, allowing security teams to search, correlate, monitor, and alert on Insights-generated detections within their existing SIEM workflows. For more agent findings, see Insights Agent Findings.

How the Splunk Cloud Integration Works

Following a successful configuration, the Splunk Connector's status appears as In Use in the PCE UI (Settings > Connectors).
Once every 24 hours, Illumio Insights Agent generates a report of findings and sends it to Splunk.
Splunk Events are created for Insights Agent findings.

Prerequisites

HEC is enabled in Splunk (Settings > Data Inputs > HTTP Event Collector > Global Settings > Enable).
A HEC Authentication Token is generated in Splunk (Settings > Data Inputs > HTTP Event Collector > New Token).
Deep Dive feature for Insights Agent is turned off.

Procedure

Perform these steps to configure the integration.

STEP 1: Set up the Splunk Cloud Connector in the PCE

In the PCE UI, go to Settings > Connectors.
On the Splunk SIEM tile, click Add.
Enter your Splunk Cloud HEC URL hostname or IP address.
Important
Don't add HTTP/HTTPS before the URL or anything after the domain extension (.com)
Enter the port number (typically 8088).
Enter the HEC Authentication token in the HEC Authentication Token field.
Determine whether the HEC endpoint uses a public CA certificate or a self-signed certificate.
- If it uses a public CA certificate, no further action is needed regarding the certificate. Proceed to Step 7.
- If it uses a self-signed certificate, you must:
1. Contact Splunk Support to obtain the certificate.
  If you're not able to obtain the certificate from Splunk Support, extract the certificate from the Splunk server. Run this command from any machine that can reach the Splunk server:
```
openssl s_client -connect <splunk_host>:<splunk_port> -showcerts </dev/null 2>/dev/null | awk '/BEGIN CERT/,/END CERT/' > splunk_cert.crt
```
  Note
  - The splunk host is of the format prd-p-tvqou.splunkcloud.com or an IP address.
  - The splunk_port is usually 8088.
2. In the Public Root CA Bundle field, click Upload, select the splunk_cert.crt file, and upload it to Illumio (*.crt or *.pem) so that Illumio can trust the connection.
Make sure the Enable Export is on so that Illumio Insights pushes data to Splunk.
Click Test the Connection to make sure the configuration is successful.
Click Save.

STEP 2: View Illumio Insights in Splunk

In Splunk, go to Search & Reporting and search for index=* | spath vendor | search vendor=Illumio.
Choose a Time Range.
View the imported Illumio findings in the Events tab.
When Illumio exports findings to Splunk via the HTTP Event Collector (HEC), each finding arrives as a single JSON event. Fields are nested into logical objects: window, finding, mitre, and affectedAssets. The Splunk JSON field path is the canonical name for each field; use dotted-path notation (for example, finding.severity) when writing SPL queries.

{ [-]
   affectedAssets: { [-] //Object identifying the workloads involved in the finding. Contains count (integer), ids (array of resource IDs), and names (array of human-readable resource names).
     count:
     ids:
     names:
   }
   eventClassId: //Static value: ANOMALY. Classifies the event type for Splunk.
   external_id: String (hash)
   finding: { [-]
     affectedFilters:
     evidence: //The supporting argument; citation-driven analysis quoting specific observables (IPs, ports, byte and flow counts, resources) and explaining why they indicate a threat. Where finding.indicator is the headline, this is the case for it. The content is Markdown; rendering it raw will display formatting syntax rather than formatted text.
     indicator: //The one-line headline of the anomaly, providing a concise description of the threat pattern.
     iocScore: //Deterministic rule-based scoring of this individual finding. A finding that was never scored serializes as {}. The object contains several keys.
     label: //Display name of finding.type (for example, "Risky Connection", "Data Exfil Attempt").
     severity: //Numeric severity assigned by the IOC scorer. Overwrites the model's severity, so finding.severity on the event reflects this post-scoring value.
     type: //Machine-readable category of the anomaly; the bucket the finding is counted under in by-type rollups. Value：risky_connection, malicious_ip, high_egress, data_exfil_attempt, unknown_destination, spike_geo_location.
     widgetTitles: //Which Insights dashboard widgets the model read to reach this finding, showing the provenance back to the UI. Contains widget-title strings copied from the source records.
   }
   finding_id: //Identifies one indicator of compromise within a report.
   mitre: { [-]
     tacticId: //ATT&CK tactic ID (TA####) for the attack stage the technique belongs to. Derived, not independently authored：looked up from mitre.techniqueId against the MITRE STIX dataset during report normalization. A technique can belong to several tactics; this field takes the first allowed one, making it a single-tactic projection of a many-to-many relationship.
     tacticName: //Human-readable name of that tactic (for example, "Exfiltration"), so displays need no ID lookup. Always consistent with mitre.tacticId, as both come from the same resolved tactic object.
     techniqueId: //The single MITRE ATT&CK technique or sub-technique the finding was classified as (T#### or T####.###). Exactly one per finding; the model selects from a constrained set of valid ATT&CK IDs. Defaults to an empty string where no technique was assigned.
   }
   persona: //threat hunter
   product: //Illumio-Agent
   report_id: //Identifies the single agent report run that produced this finding.
   risk_level: //Report-level indication of how much attention the report needs：1 = Low, 2 = Medium, 3 = High, 4 = Critical. This value is report-level and broadcast onto every finding row in the report; it is not a per-finding score (that lives in finding.severity and finding.iocScore). Null where a persona emits no prioritization section.
   tenantId: //The Illumio tenant (customer environment) the finding belongs to, and the partition key for the export (the only tenancy boundary in the file).
   vendor: //Illumio
   version: //1.0
   window: { [-]
     end: //End of the current analysis window. For the automatic daily run, the window is anchored to America/Los_Angeles midnight and converted to UTC.
     recordTime: //When the report row was created; specifically, when the analysis run started, not when the finding was written or when the event was produced.
     start: //Start of the current analysis window; the observation period the agent analyzed to produce this finding.
   }
}

To Disable the Connection

Perform these steps if you need to disable Illumio's Splunk SIEM connection.

In the PCE UI, go to Settings > Connectors.
Click the Splunk SIEM tile.
Click Edit.
At the bottom of the page, toggle Enable Export off.
Click Save.

Integrations