Integration

​

Configuring the Integration

1. In your FalconFeeds Dashboard, go to Settings → Integrations → Splunk HEC.

2. Click Add.

3. Enter the HEC URL and Token retrieved from your Splunk instance. By default, FalconFeeds sends events with the following HEC attributes:

   Attribute	Default Value
   index	main
   sourcetype	_json
   source	falcon:threatFeed

   Toggle Use custom HEC attributes to override any of these values.

4. Click Save. FalconFeeds will now begin sending new threat feed events directly to your Splunk environment.

​

Testing the Integration

1. Click the Test button on your integration card.

2. Click Run test. FalconFeeds will send a sample threat post to your Splunk environment using the configured values. If the test fails, the corresponding HTTP status code will be displayed.