Splunk Integration

Forward detection events to Splunk for centralized security monitoring, threat hunting, and SIEM dashboards.

Prerequisites

• Splunk Cloud or Splunk Enterprise
• HTTP Event Collector (HEC) enabled
• HEC token with write access

Getting Splunk Credentials

Enable HTTP Event Collector

1. Log into Splunk Web
2. Go to Settings → Data Inputs
3. Click HTTP Event Collector
4. Click Global Settings
5. Set All Tokens to Enabled
6. Click Save

Create HEC Token

1. In HTTP Event Collector, click New Token
2. Enter name: “WebDecoy Integration”
3. Click Next
4. Select Input Settings:
   • Source type: leave as Automatic. WebDecoy sets the sourcetype on every event it sends (webdecoy:detection unless you change it in WebDecoy).
   • App context: search
   • Index: Select your security index
5. Click Review → Submit
6. Copy the generated token

Configuring Integration

1. Go to Integrations → Splunk

2. Click Add Splunk Integration

3. Enter:

   Field	Description
   Name	A label for this integration
   HEC URL	Your Splunk HEC endpoint. WebDecoy appends /services/collector/event if it is missing
   HEC Token	HTTP Event Collector token (stored encrypted)
   Source Type	The sourcetype set on each event. Default: webdecoy:detection
   Source	The source set on each event. Default: webdecoy
   Index (optional)	Target index. Leave empty to use the token’s default index
   Verify SSL	TLS certificate verification. On by default

4. Choose which events to send:

   Setting	Description
   All Detections	Every detection (on by default)
   High Risk Detections (Score >= 80)	Only detections whose unified score is 80 or higher
   Rule Enforced Events	Detections where a response action enforced successfully
   Minimum Score (optional)	Skip detections below this unified score
   Filter by Decoys (optional)	Only send detections from the selected decoys

5. Click Create Integration, then use Test on the integration card to send a test event.

HEC URL Format

Deployment	URL Format
Splunk Cloud	https://http-inputs-<stack>.splunkcloud.com:443
Splunk Enterprise	https://<your-server>:8088
Splunk Cloud Classic	https://input-<stack>.cloud.splunk.com:443

The HEC endpoint must be reachable from the public internet. WebDecoy refuses to send to private, loopback and link-local addresses, so an on-premises HEC needs a public hostname.

Event Format

Detections are sent as JSON events to Splunk. Illustrative example (fields that have no value for a detection are omitted, and the network flags are only sent when true):

{
  "time": 1784111400.123,
  "host": "webdecoy",
  "source": "webdecoy",
  "sourcetype": "webdecoy:detection",
  "index": "security",
  "event": {
    "detection_id": "det_abc123",
    "event_type": "detection",
    "source_type": "decoy_link",
    "ip_address": "192.168.1.100",
    "unified_score": 85,
    "bot_score": 92,
    "threat_level": "CRITICAL",
    "threat_category": "scanner",
    "confidence": 0.94,
    "request_method": "GET",
    "user_agent": "Mozilla/5.0...",
    "geo_country": "US",
    "geo_city": "New York",
    "geo_latitude": 40.7128,
    "geo_longitude": -74.006,
    "is_vpn": true,
    "abuse_confidence_score": 97,
    "rules_enforced": false,
    "organization_id": "3f1c2a9e-...",
    "property_id": "8b7d4e21-...",
    "decoy_id": "c2e9f6a0-...",
    "timestamp": "2026-07-15T10:30:00Z"
  }
}

Event Fields

Field	Type	Description
detection_id	string	Unique detection identifier
event_type	string	detection, high_risk_detection (unified score or bot score 80+), rule_enforced (not sent today)
source_type	string	The detection source, e.g. decoy_link, bot_scanner, endpoint, sdk, wordpress_plugin, edge_worker
ip_address	string	Source IP address
unified_score	number	Headline threat score (0-100)
bot_score	number	Bot-likelihood component score
threat_level	string	MINIMAL, LOW, MEDIUM, HIGH, CRITICAL
threat_category	string	e.g. scraper, scanner, attacker
confidence	number	Detection confidence (0 to 1)
referer	string	Referer header, when present
request_method	string	HTTP method
user_agent	string	Browser/client user agent
geo_country / geo_city	string	GeoIP location
geo_latitude / geo_longitude	number	GeoIP coordinates
is_vpn / is_proxy / is_tor / is_relay	boolean	Network risk flags (sent only when true)
signature_verified / token_verified	boolean	Cryptographic identity checks (sent only when checked)
cryptographic_trust	number	Combined cryptographic trust (0 to 1), sent only when above 0
abuse_confidence_score	number	AbuseIPDB abuse score
reverse_dns_hostname	string	Reverse DNS hostname, when resolved
is_known_bot / known_bot_name	boolean / string	Set when reverse DNS matches a known crawler
rule_enforcement_error	string	Why enforcement failed, when it did
rules_enforced	boolean	Whether a response action enforced
organization_id / property_id / decoy_id / scanner_id	string	Resource identifiers
timestamp	string	ISO 8601 timestamp

Splunk Searches

Basic Detection Search

index=security source=webdecoy
| stats count by threat_level

High-Risk Detections

index=security source=webdecoy threat_level IN ("HIGH", "CRITICAL")
| table _time, ip_address, source_type, unified_score, threat_category
| sort - unified_score

Detection Trends

index=security source=webdecoy
| timechart span=1h count by source_type

Top Attacking IPs

index=security source=webdecoy
| stats count, avg(unified_score) as avg_score by ip_address
| sort - count
| head 20

Known Crawlers

index=security source=webdecoy is_known_bot=true
| stats count by known_bot_name, ip_address
| sort - count

Geographic Distribution

index=security source=webdecoy
| iplocation ip_address
| geostats count by Country

Threat Category Analysis

index=security source=webdecoy
| stats count by threat_category
| sort - count

Building Dashboards

Recommended Panels

Detection Overview:

index=security source=webdecoy
| timechart span=1h count by threat_level

Threat Level Distribution:

index=security source=webdecoy
| stats count by threat_level
| sort - count

Top Decoy Paths:

index=security source=webdecoy source_type=decoy_link
| stats count by decoy_id
| sort - count
| head 10

Real-Time Detection Feed:

index=security source=webdecoy
| table _time, ip_address, threat_level, source_type, unified_score
| sort - _time
| head 50

Sample Dashboard XML

<dashboard>
  <label>WebDecoy Security Dashboard</label>
  <row>
    <panel>
      <title>Detections Over Time</title>
      <chart>
        <search>
          <query>index=security source=webdecoy | timechart span=1h count by threat_level</query>
        </search>
        <option name="charting.chart">column</option>
        <option name="charting.chart.stackMode">stacked</option>
      </chart>
    </panel>
    <panel>
      <title>Threat Level Breakdown</title>
      <chart>
        <search>
          <query>index=security source=webdecoy | stats count by threat_level</query>
        </search>
        <option name="charting.chart">pie</option>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <title>Top Attacking IPs</title>
      <table>
        <search>
          <query>index=security source=webdecoy | stats count, max(unified_score) as max_score by ip_address | sort - count | head 10</query>
        </search>
      </table>
    </panel>
    <panel>
      <title>Threat Categories</title>
      <chart>
        <search>
          <query>index=security source=webdecoy | stats count by threat_category | sort - count</query>
        </search>
        <option name="charting.chart">bar</option>
      </chart>
    </panel>
  </row>
</dashboard>

Alerting

High-Risk Detection Alert

Create a saved search with alerting:

index=security source=webdecoy threat_level=CRITICAL
| stats count
| where count > 0

Alert settings:

• Schedule: Every 5 minutes
• Trigger: When number of results > 0
• Action: Send email / Slack / PagerDuty

Detection Spike Alert

index=security source=webdecoy
| timechart span=5m count as detection_count
| streamstats window=12 avg(detection_count) as avg_count stdev(detection_count) as stdev_count
| eval threshold = avg_count + (3 * stdev_count)
| where detection_count > threshold

High-Volume Property Alert

index=security source=webdecoy
| stats dc(ip_address) as unique_ips count as total_detections by property_id
| where total_detections > 100

New Attacker Alert

index=security source=webdecoy threat_level IN ("HIGH", "CRITICAL")
| stats earliest(_time) as first_seen count by ip_address
| where first_seen > relative_time(now(), "-1h")

Correlation Rules

Correlate with Other Security Data

index=security (source=webdecoy OR source=firewall OR source=ids)
| eval event_source=source
| stats count by ip_address, event_source
| xyseries ip_address event_source count

Multi-Stage Attack Detection

index=security source=webdecoy
| transaction ip_address maxspan=1h
| where eventcount > 3
| table ip_address, eventcount, duration, source_type

Enterprise Security Integration

If using Splunk Enterprise Security (ES):

Notable Event Creation

Configure WebDecoy events to create ES notable events:

1. Go to Configure → Content → Content Management
2. Create new correlation search
3. Use search:

   index=security source=webdecoy threat_level=CRITICAL
   | eval src=ip_address, dest=property_id

4. Enable adaptive response action: Create Notable Event

Threat Intelligence

Integrate WebDecoy IPs with threat intel:

index=security source=webdecoy
| lookup threat_intel ip AS ip_address OUTPUT threat_type
| where isnotnull(threat_type)

Best Practices

Do’s

• ✅ Use a dedicated security index
• ✅ Set appropriate retention policies
• ✅ Create role-based access to WebDecoy data
• ✅ Build dashboards for security operations
• ✅ Set up alerts for critical detections
• ✅ Correlate with other security data

Don’ts

• ❌ Forward to main index (use security index)
• ❌ Ignore index sizing for high-volume events
• ❌ Skip HEC token rotation
• ❌ Use admin credentials for HEC token

Troubleshooting

Events Not Appearing

1. Verify HEC URL is correct and publicly reachable
2. Check the integration card for the last error. WebDecoy sends each event once and does not retry a failed delivery
3. Check HEC token is valid and enabled
4. Test HEC endpoint directly:

   curl -k "https://<hec-url>/services/collector" \
     -H "Authorization: Splunk <token>" \
     -d '{"event": "test"}'

5. Check target index exists and has capacity
6. Verify the Source Type, Source and Index configured in WebDecoy match your search

Authentication Errors

1. Regenerate HEC token
2. Verify token hasn’t been disabled
3. Check token permissions include target index
4. Ensure Global Settings has tokens enabled

Performance Issues

WebDecoy sends one HEC request per detection, without indexer acknowledgment. If volume is high:

1. Narrow what is sent with Minimum Score or High Risk Detections
2. Monitor HEC queue size on the Splunk side

SSL Certificate Errors

1. Verify certificate chain is complete
2. For a self-signed certificate, turn off Verify SSL on the integration (the private-address restriction still applies)
3. Use correct port (8088 for Enterprise, 443 for Cloud)

---

Next Steps

• CrowdStrike - Falcon LogScale integration
• Datadog - Alternative SIEM option
• Overview - All integrations