SIEM
Splunk
TechWatchAlert security events in Splunk through the HTTP Event Collector, ready to correlate.
What the connector does
TechWatchAlert sends your organization's security events to your HTTP Event Collector, on Splunk Enterprise or Splunk Cloud, in the index and sourcetype of your choice. Each event keeps its timestamp and a stable identifier.
What comes into TechWatchAlert
- Detected vulnerabilities, tier and status changes, reported exploitation, reopened cases and verified fixes
- Machines that became exposed or were fixed, compliance and external attack surface findings
- Optionally, the actions in your organization's audit log
- JSON with a stable, versioned schema, with configurable index, sourcetype and source
Setup
- In Splunk, create an HTTP Event Collector token (Settings › Data inputs › HTTP Event Collector) allowed on the target index
- In Organization settings › Security › SIEM, choose Splunk and enter the collector address and the token
- Choose the events to send, then “Test and save”
In the same family
Syslog TLS (CEF or JSON)TechWatchAlert security events in your syslog collector, encrypted over TLS, in CEF or JSON.View connector →Microsoft SentinelTechWatchAlert security events in a table of your Log Analytics workspace, queryable in KQL.View connector →ElasticTechWatchAlert security events in an Elasticsearch data stream, with ECS fields.View connector →
Connectors
Plug in your tools in minutes
Start with a repository, a fleet or a scan report: your first targeted alerts arrive with the first sync.
Free plan, no credit card · hosted in France