Configure API Alerts Input for Splunk SIEM

To configure an API Alerts input for Splunk SIEM, perform the following procedure.

Prerequisites

Configure Built-in Inputs for Splunk SIEM

Procedure

1. In the Splunk SIEM console, in the Application Configuration menu, click the Alerts Input tab.
2. To create a new configuration, click the + in the top right corner of the page.
3. Enter a name for the configuration.
4. Set Minimum Severity to the desired level. The default value is 4.
5. Select the Alert type. The default value is All.
6. Select the API token that you configured in Set up Authentication and Authorization for Splunk SIEM.
   Note: Make sure that the Splunk Access Level has the required permissions specified in API Data Inputs.
7. Select the proxy that you configured in Step 4 of Configure Built-in Inputs for Splunk SIEM. If you are not using a proxy, select None.
8. Set Lookback to 0 unless you need to retrieve data from previous days. The default value is 7 days.
9. Set the Index to the Base Index name from Carbon Black Cloud Base Configuration; for example, carbonblackcloud.
10. Set the Interval to the desired poll cycle. The default value is 300 seconds.
    Note:

    • If your organization generates a significant amount of alerts, consider using the Data Forwarder option (see Data Forwarder Alerts Input Configuration for Splunk SIEM).
    • The query will use the same syntax as the Search bar on the Alerts page in the Carbon Black Cloud console.