​

Authentication

• api_key: Splunk API Key (required: True, sensitive: True)
• host: Splunk Host (default is localhost) (required: False, sensitive: False)
• port: Splunk Port (default is 8089) (required: False, sensitive: False)
• verify: Enable SSL verification (required: False, sensitive: False)
• username: The username connected with the API key/token provided. (required: False, sensitive: False)

• list_all_objects: The user can get all the alerts (mandatory)
• edit_own_objects: The user can edit and add webhook to saved_searches (mandatory)

​

In workflows

​

Connecting with the Provider

1. Ensure you have a Splunk account with the necessary permissions. The basic permissions required are list_all_objects & edit_own_objects.
2. Get an API token for authenticating API requests. Read More on how to set up and get API Keys.

1. Determine the Host (IP address or hostname) and Port (default is 8089 for Splunk’s management API) of the Splunk instance you wish to connect to.

​

NOTE Make sure to follow this Guide to configure your webhook allow list to allow your keep deployment.

​

Useful Links

• Splunk Python SDK
• Splunk Webhook
• Splunk Webhook Allow List
• Splunk Permissions and Roles
• Splunk API tokens