You can specify the HEC token as a query string in the URL that you specify in your queries to HEC. This can be done with the format shown below: ``` ?token=
``` https://mysplunkserver.example.com:8088/services/collector/raw?token=12345678-1234-1234-1234-1234567890AB ``` ### ### For Splunk Cloud Customers: For Splunk Cloud customers, the above example URL will look different including the public facing HEC URL. The endpoint (`/services/collector/raw?token=12345678-1234-1234-1234-1234567890AB`) should remain the same, however. Since you are on a Splunk Cloud instance, this URL should already be visible to the Nightfall console, and you would be able to start using this Webhook URL in the Nightfall console. Please continue with the steps after this section to complete webhook set up. ### **For Splunk Enterprise Customers**: For Splunk Enterprise customers, there are a few extra steps to have the Splunk Collector exposed to the Nightfall webhook console below. The next step will be exposing the local host and port of the Splunk collector an HTTP Listening tool. This can be done by using an ngrok tunnel or nginx server, for example This is required so that the Enterprise Splunk instance is accessible to Nightfall's webhook from the console. Please make sure that port 8088 (this is the default port for receiving data for HEC) is accessible by navigating to "Global settings" in your Splunk Enterprise instance and enabling it. Steps for setting up a ngrok tunnel can be found [here](https://ngrok.com/docs). If using a ngrok tunnel, the following command would generate a ngrok tunnel listening to the correct port and protocol for the collector:
`./ngrok http https://localhost:8088` Once complete, the ngrok tunnel should show you an HTTPS Forwarding address, that can be used as the ngrok host in the following step. (HTTPS is required by Nightfall's webhook URL validation) Your ngrok tunnel URL with your HEC auth token should now look something like this: [`https://
{
"detectionRulesLink": "https://app.nightfall.ai/detection-engine/detection-rules/",
"detectionRulesViolated": [
{
"eventType": "violation",
"service": "Slack",
"companyUUID": "0957cfbd-3e71-41e5-a2eb-691668fa5572",
"fileName": "",
"foundIn": "Public Channel",
"who": {
"username": "",
"fullName": "aziz_demo",
"email": "",
"userID": "U038GT1SKFE"
},
"permalink": "https://yoourco.slack.com/archives/C038T5N5GM7/p1668033451531234",
"violationLink": "https://app.nightfall.ai/violations/fa7c7a95-c46c-4c3d-ab78-2b63cccc1234",
"violationTime": "2022-11-09T22:37:34.808263861Z",
"integrationMetadata": {
"workspaceName": "",
"channel": "demo",
"channelID": "C038T5N5GM7"
},
"findings": [
{
"detectionRule": {
"uuid": "c983ff3b-a005-45da-b104-1522c0d9c712",
"name": "HBI Internal Person & Project Names"
},
"policy": {
"uuid": "3c55d347-34a8-4987-a077-b00e9d70649e",
"name": "My Slack Policy"
},
"detector": {
"uuid": "293bda1f-00e7-4ac2-b580-2c9512816140",
"name": "V.I.P List"
},
"occurrences": [
{
"snippet": "ey Brian did you see Go********** in the building toda"
}
],
"detectionRuleLink": "https://app.nightfall.ai/detection-engine/detection-rules?selectedDetectionRules=c983ff3b-a005-45da-b104-1522c0d9c712",
"policyLink": "https://app.nightfall.ai/slack/policies/3c55d347-34a8-4987-a077-b00e9d70649e"
},
{
"detectionRule": {
"uuid": "29d5f705-6954-4883-a903-3c960ebc3960",
"name": "My Detection rule"
},
"policy": {
"uuid": "accdb5a7-db06-4614-9495-cdeb74b305cb",
"name": "My Policy"
},
"detector": {
"uuid": "f480b42c-2724-4264-aa12-79044fa6b1c1",
"name": "My Dictionary of secret entries"
},
"occurrences": [
{
"snippet": "ey Brian did you see Go********** in the building toda"
}
],
"detectionRuleLink": "https://app.nightfall.ai/detection-engine/detection-rules?selectedDetectionRules=29d5f705-6954-4883-a903-3c960ebc3960",
"policyLink": "https://app.nightfall.ai/slack/policies/accdb5a7-db06-4614-9495-cdeb74b305cb"
}
]
}