push connector · hec

Wytness for Splunk

Anomalies pushed straight to your Splunk index via the HTTP Event Collector. One HEC token. One index. Your saved searches work unchanged.

what it does

Where your alerts land

Splunk is the system of record for many SOC teams. Wytness writes anomalies directly to the index you pick, as newline-delimited HEC events. Your existing saved searches, alerts, and dashboards work the same way they work for any other HEC source.

setup

From nothing to first delivery

In Splunk Web, go to Settings → Data inputs → HTTP Event Collector and create a new token. Pick an index (we recommend `wytness_audit`) and keep the default sourcetype (`_json` is what deliveries use).

On self-hosted Splunk, confirm HEC is enabled globally (Global Settings) and on the token you just created.

Copy the token value and your HEC endpoint URL — self-hosted uses port 8088; Splunk Cloud uses https://http-inputs-<stack>.splunkcloud.com on 443.

In the Wytness app, go to Integrations → Connectors → Add connection → Splunk HEC and enter the endpoint and the HEC token, plus the optional index/sourcetype overrides. Self-hosted or trial HEC still on Splunk's default certificate? Either install a publicly-trusted certificate or switch off Verify TLS certificate on the connection.

Click Test connection. A Wytness test event should appear in your index within seconds.

the payload

What arrives in your index

One HEC envelope per anomaly, newline-terminated. The event timestamp rides the envelope's time field (epoch seconds), so _time is the detection time. index appears only when you set the index override; otherwise the token's pinned index applies.

splunk_payload.json

1{
2  "time":       1716470621.182,
3  "sourcetype": "_json",
4  "index":      "wytness_audit",
5  "event": {
6    "alert_id":    "9f2d1c34-8a7b-4e2d-b1a0-5c6d7e8f9a0b",
7    "agent_id":    "payments-reconciler-v3",
8    "rule_name":   "off_hours_activity",
9    "severity":    "high",
10    "description": "Tool invocation outside business hours window.",
11    "detected_at": "2026-05-23T14:23:41.182Z",
12    "source":      "wytness",
13    "wytness_url": "https://app.wytness.ai/anomalies?alert_id=9f2d1c34-8a7b-4e2d-b1a0-5c6d7e8f9a0b"
14  }
15}

prove it landed

Verify end to end

The wizard's Test connection delivers a real event before you save. To see the stream in Splunk afterwards:

verify.sh

1# Optional handshake from your laptop (self-hosted; -k skips the default
2# self-signed cert):
3$ curl -sk https://splunk.example.com:8088/services/collector/event \
4    -H "Authorization: Splunk $HEC_TOKEN" \
5    -d '{"event":"hec-handshake","sourcetype":"_json"}'
6 
7# Then, after a Wytness test delivery, in Splunk Web search:
8#
9#   index=wytness_audit sourcetype=_json rule_name=* earliest=-1h
10#   | stats count by rule_name severity
11#   | sort -count

the boundary

What flows and what doesn't

Writes

Anomaly records as newline-delimited HEC envelopes

Auth

`Authorization: Splunk <hec-token>` (the token is the secret, stored encrypted in Wytness)

Reads

Nothing. We don't run REST searches against your indexes.

Other indexes

Not touched. Wytness only writes to the index pinned on the HEC token.

Network

Splunk Cloud: no change on your side. Self-hosted: allow inbound HTTPS to your HEC endpoint — Wytness source IPs are not fixed, so authenticate with the HEC token, not an IP allowlist.

what you need

Required permissions

✓HEC enabled at the global level and on the Wytness token
✓An index for Wytness anomaly records (recommended: `wytness_audit`)
✓A new HEC token scoped to that index, with default sourcetype

stated plainly

Limitations

—

IP allowlists

Splunk Cloud can restrict HEC by source IP, but Wytness delivery IPs are not fixed — keep HEC reachable and rely on the token as the credential. A Splunkbase pull-side app is on the roadmap for estates that cannot accept inbound HEC; the generic webhook to your own forwarder works today.

—

Default certificates

Fresh self-hosted Splunk and Cloud trials serve HEC with Splunk's default certificate, which is not publicly trusted. Deliveries verify TLS by default and will fail with an explanatory error until you install a trusted certificate or switch off Verify TLS certificate on the connection.

—

License volume

HEC events count against your daily license volume. Wytness sends one record per anomaly, not per event; at launch volumes this is measured in MB per month.

—

PII pseudonymisation

Anomalies sent to Splunk are already pseudonymised on the way in. Splunk sees the same EMAIL_a3f9b1c4 pseudonym shape your auditor sees in the Evidence Pack.

Keep reading

/docs/connectors

Connector setup guide

The full integrator contract — network requirements, delivery semantics, and every wizard field. Read the guide.

/connectors

All connectors

Sentinel, Splunk, ServiceNow, Slack, and the generic webhook. See the index.

tier

Tier availability

Business plan or higher.

One HEC token. One index. Your saved searches keep working.

Start recording Ask a question