Skip to main content

Splunk Enterprise

This new Splunk Enterprise connector and app replaces the legacy ASCERA for Splunk and ASCERA CMMC apps and connector setup. This documentation is specifically for the new connector and is not applicable to the legacy connector.

Configure the ASCERA SaaS Connector App for Splunk​

This guide walks through the initial setup for the ASCERA SaaS Connector app for Splunk. You will configure the app license, create the Splunk Enterprise connector in ASCERA SaaS, add the ASCERA integration details in Splunk, initialize lookups, and configure remote automation execution.

Prerequisites​

Before you begin, make sure you have the following:

  • ASCERA SaaS Connector app for Splunk installed
  • Splunk user with the admin role
  • License for the ASCERA SaaS Connector app. Request this from ASCERA Support.
  • System ID and Framework ID. Request these from ASCERA Support.

Apply the ASCERA License in Splunk​

  1. Launch the ASCERA SaaS Connector app in Splunk.
  2. Navigate to Configuration > Licensing.
  3. In the Add new license input box, paste the license.
  4. Click Apply license.

You should see the License Status line indicate Valid license.

Create the Splunk Enterprise Connector in ASCERA SaaS​

  1. In ASCERA SaaS, navigate to ConMon: Maintain > Connectors.
  2. Click the Available tab.
  3. Search for Splunk Enterprise.
  4. Click the Splunk Enterprise connector card.
  5. Provide a connector name.
  6. Fill in the following fields:
FieldDescription
Base URLThe URL for your Splunk instance. Example: https://splunk.example.com:8000
Index Scope MacroThe macro used to scope automation searches to specific indexes. The default is index=*, which should work well if your full Splunk instance is in scope for automations. If you want to scope down to specific indexes, update the macro to be more specific. Example: index=* NOT index=dev_*. We highly recommend scoping based on the index field.
  1. Submit the form.

ASCERA SaaS will provide the following details after the connector is created. Make a note of them because you will need them in Splunk.

  • Status
  • Evidence
  • ASCERA Automation Polling URL
  • Authorization Token

Add ASCERA Integration Details in Splunk​

  1. In the ASCERA SaaS Connector app in Splunk, navigate to Configuration > ASCERA Integration Setup.
  2. Click Add Integration Details.
  3. Fill out the form with the following details:
FieldValue
Evidence URLUse the Evidence value from the connector details in ASCERA SaaS.
Status URLUse the Status value from the connector details in ASCERA SaaS.
Automation Polling URLUse the ASCERA Automation Polling URL value from the connector details in ASCERA SaaS.
API TokenUse the Authorization Token value from the connector details in ASCERA SaaS.
System IDUse the System ID provided by ASCERA Support.
Framework IDUse the Framework ID provided by ASCERA Support.
  1. Save the integration details.

Initialize ASCERA Lookups​

  1. Navigate to Configuration > Initialize Lookups.
  2. Click Initialize All.

This initializes the lookups necessary for ASCERA to function properly.

Bootstrap the ASCERA App​

  1. Navigate to Resources > Backup & Upgrade.
  2. Click Execute Search.

This triggers the saved searches necessary to bootstrap the app.

Configure Remote Automation Execution​

  1. In Splunk, navigate to Settings > Data Inputs.
  2. In the list of data inputs, click ASCERA Connector Remote Automation Execution.
  3. On the Remote Automation Execution page, click New.
  4. Enter the following details:
FieldValue
NameASCERA SaaS, or another descriptive name you would like to use.
  1. Click Next.

Next Steps​

The ASCERA SaaS Connector app for Splunk is now configured and ready to use. The automations that ship with the Splunk Enterprise connector will be able to run and return results to ASCERA SaaS.