> For the complete documentation index, see [llms.txt](https://docs.fusion.vectra.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.fusion.vectra.ai/automate-responses/configuring-response-integrations/splunk.md).
# Splunk
## Usage
By connecting Splunk's robust data analysis capabilities with Vectra's network insights, organizations gain real-time alerting, monitoring, and comprehensive views of their security landscape. This integration also streamlines workflows, aids in compliance reporting, and offers scalable solutions that adapt to evolving needs, thus providing a valuable tool for improving decision-making, security response, and overall efficiency.
## Prerequisites
Before configuring the Splunk integration in Vectra, you will need to create a new Token for the HTTP Event Collector. For more information, consult the [HTTP Event Collector documentation](https://docs.splunk.com/Documentation/Splunk/latest/Data/UsetheHTTPEventCollector) for Splunk.
## Vectra portal steps
In **Settings > Response Integrations**, click **Add Integration**. Select **Splunk**
## Configuration
The following fields are specific to the Splunk integration.
The webhook URL should point to the `services/collector/raw` endpoint of the HTTP Event Collector, as described in [Splunk HTTP Event Collector Documentation](https://docs.splunk.com/Documentation/Splunk/latest/Data/UsetheHTTPEventCollector#Send_data_to_HTTP_Event_Collector).
Ensure that the HTTP Event Collector port can be reached from Vectra's "integrations" IP address, which can be obtained from the Settings Overview page in the Vectra Fusion portal.
| Field | Required | Description | Example |
| ----------------------- | -------- | ------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------- |
| `URL` | yes | The webhook URL from Splunk | `https://splunkhec.example.com:8088/services/collector/raw` |
| `Skip SSL Verification` | no | If checked, the server certificate will not be validated against the available certificate authorities. | |
| `Headers` | no | Comma separated list of `header: value` pairs | `X-Vectra: Webhook` |
## Authentication
The following fields are necessary for the integration to authenticate using HTTP Basic Auth.
| Field | Required | Description |
| ---------- | -------- | -------------------------------------- |
| `Username` | no | Name of the HTTP Event Collector Token |
| `Password` | no | Token Value |
{% hint style="info" %}
**After your configuration is submitted, the Splunk integration will be treated as a standard webhook integration in the Fusion portal.**
{% endhint %}
### Additional post configuration
After the Splunk configuration is setup, you will need to configure a Response Policy in the Fusion portal.
#### Configure a Response Policy to Sent Events to Splunk
You can configure response policies in the portal by navigating to **Response -> Response Policies -> Add Response Policy**.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.fusion.vectra.ai/automate-responses/configuring-response-integrations/splunk.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.