Realm.Security Documentation

Appearance

Splunk Integration ​

Realm integrates with Splunk by forwarding processed security events to a Splunk HTTP Event Collector (HEC) endpoint. This allows you to use Realm as part of your existing Splunk workflow — enriching, normalizing, and routing logs through Realm before they land in Splunk for search and alerting.

Note: This guide covers using Splunk as a destination (Realm → Splunk). To ingest logs from Splunk into Realm, see the Splunk HEC Source guide.

1. Configure an HTTP Event Collector in Splunk ​

  1. Login to the Splunk Console
  2. Go to Settings > Data Inputs

Splunk data inputs

  1. Select HTTP Event Collector

Splunk http event collector

  1. Click on New Token

Splunk new token

  1. Enter a name for the token:

Realm.Security

Splunk Config token form

  1. Select an index to save data to or Create New Index

Splunk Select index

  1. Click Review

Splunk Review add data form

  1. Click Submit
  2. Copy the token value and save it securely — you'll need it in the next section

Splunk Token value

🔗 Helpful Links

2. Configure an Output Feed in Realm ​

  1. Create a Destination for Splunk:

    • Use the Endpoint and Token obtained in the previous section

  2. Add a new Output Feed:

    • Set the Name (e.g., Splunk Output)

    • Optionally add a Description

    • Select Splunk as the method

    • Enter the Endpoint

      Example:

      text
      https://http-inputs-<host>.splunkcloud.com

Note for Splunk Cloud Users
When configuring an Output Feed for Splunk Cloud, ensure your HEC endpoint follows this format:
https://http-inputs-<host>.splunkcloud.com

Failing to specify https can result in data being sent in an unexpected or unsupported format.

View Splunk’s official guidance

  1. Paste the Token from the previous step
  2. Choose the Format — we recommend starting with JSON or RAW unless otherwise specified

Troubleshooting ​

If data is not flowing through to Splunk

  • check if the Splunk token has permission to write to the configured index
  • check if there are any IP restrictions on Splunk ingestion ensure Realm IP range is allowed. Please contact Realm support to get a fixed IP range that can be whitelisted.

Export Detections for Detection Integrity ​

Detection Integrity checks your log optimization rules against your Splunk detections, so optimizations never drop data a detection depends on. Export your detections as described below, then upload them to Realm.

Export all relevant detections using following options:

Option 1: Export content from Splunk Enterprise Security as an app ​

See Splunk Enterprise Security - Administer - Managing security cotent

  1. From Splunk Enterprise Security menu bar, select Security content then Content management.
  2. Select the check boxes of the detections (saved searches) you want to export.
  3. Select Edit Selection and select Export.
  4. Type an App name. This will be the name of the app file. For example, splunkES_detections_to_realm_date.
  5. Select No Prefix.
  6. Type a Label. This reflects the name of the app. For example, ES Detections to Realm.
  7. Select Export.
  8. Select Download app now to download the app package to the search head at the location $SPLUNK_HOME/etc/apps/SA-Utils/local/data/appmaker/*. "Download app now" generates a compressed file and caches it directly inside the SA-Utils directory on your search head.

Option 2: Export scheduled searches using Splunk rest command ​

  1. Using Splunk Search: run the rest searches, ensure to include all apps with enabled detections within search parameter.

SPL to get all scheduled saved searches from related apps

| rest "/servicesNS/-/-/saved/searches"  
| search NOT search="| noop"  
| eval Type="Saved Searches/Alerts/Reports"  
| search eai:acl.app IN(SplunkEnterpriseSecuritySuite, <INCLUDE_ALL_APPS_WITH_DETECTIONS>) 
| search is_scheduled = 1  
| table Type title eai:acl.app search

SPL to get enabled finding-based searches

| rest /servicesNS/-/SplunkEnterpriseSecuritySuite/saved/searches 
| where match('action.correlationsearch.enabled', "1|[Tt]|[Tt][Rr][Uu][Ee]")
| where disabled=0
| eval Type="Correlation Searches"  
| table Type title search

SPL to get macro definitions

| rest /servicesNS/-/-/admin/macros 
| search eai:acl.app IN(SplunkEnterpriseSecuritySuite, <INCLUDE_ALL_APPS_WITH_DETECTIONS>)  
| table title, definition eai:acl.app 
| rename title as macro
  1. Once search job has completed, click Export.

alt text

  1. Select CSV as format
  2. Click Export.

alt text

Upload the Export to Realm ​

Upload the exported file as described in Upload Detections to Realm, selecting your Splunk destination.

Support ​

For additional details, refer to the official Splunk documentations:

Splunk export search results

Splunk Finding-based Detections

Splunk rest command

If you encounter any issues or require assistance, contact Realm Security support.