Beyond Identity Secure Work Events Data Integration with Splunk Cloud and Enterprise – Beyond Identity

Overview

This guide provides step-by-step instructions for integrating event data from the Secure Work platform into Splunk Cloud and Splunk Enterprise. The integration allows security teams and administrators to centralize logs, visualize activity, and generate alerts within Splunk, enhancing visibility into events generated by Secure Work.

By following this guide, you will learn how to:

Configure the Secure Work platform to send event data.
Connect and authenticate with Splunk Cloud or Splunk Enterprise.
Verify that data is flowing into Splunk.

This integration ensures that your organization can leverage Splunk’s powerful analytics and monitoring capabilities alongside Secure Work’s event data for improved incident detection, investigation, and response.

Prerequisites

Before beginning the integration, ensure you have the following:

Configured Secure Work tenant
You must have an active and properly configured Beyond Identity Secure Work tenant. This includes access to the Secure Work Admin Console with permissions to generate API keys or configure event forwarding.
Admin-level Splunk Cloud account
An account in Splunk Cloud or Splunk Enterprise with administrative privileges is required. This ensures you can create data inputs, configure authentication tokens, and manage indexes where Secure Work event data will be stored.
Network and connectivity requirements
Verify that outbound connections from Secure Work to Splunk Cloud/Enterprise are not restricted by your organization’s firewall or proxy settings.

Steps

Creating an HTTP Event Collector

1. Access your Splunk Cloud or Enterprise admin console and login as a user with administrative privileges.

2. On the top navigation menu, click Settings.

3. Next, from the Settings drop-down menu, click Data inputs.

4. In the Data inputs section, look for the HTTP Event Collector type, and under Actions, click +Add new.

5. To configure a new token for receiving data over HTTP, provide a Name.

6. Leave all the other fields blank, then click Next.

7. In the Input Settings page's Index section, click add all.

8. Click the Default Index drop-down and select main. When you are finished, click Review.

9. Review the configuration details, then click Submit.

10. If the token is created successfully, copy its value and store it in a secure location. You will need this token in later steps.

11. Locate the HTTP Event Collector you just created and under Actions click Edit. Under Source Type, type beyond_identity_log and click Save.

Beyond Identity Console Configuration

12. Log in to your Beyond Identity Secure Work tenant.

13. On the left-hand navigation menu, click Integrations.

14. Next, click the SIEM tab.

15. Then, click Add SIEM Integration.

16. In the dialog window, select Splunk as the SIEM Provider.

17. Enter the following details:

Name – Provide a descriptive name for the integration. You can choose any value that helps you identify this configuration later.
HEC Token – Paste the token you copied from the Splunk console (see Step 10).
HEC Host – Enter the URL of your Splunk instance. Do not include the https:// prefix.
HEC Port - Enter 8088. Note: This port should be open for SSL traffic in the firewall for Beyond Identity event integration to work correctly.
Events - Select the event types that you want to receive in Splunk.
Threat Signals - Select the threat signals that you want to receive in Splunk.
Status - Toggle to ACTIVE.

18. After entering all required information, click Test Configuration to verify that the integration is working correctly.

19. A confirmation banner will appear stating, Your configuration is valid. This indicates that Secure Work can successfully send event data to your Splunk account.

20. Next, click Save Changes.

Verify Events in Splunk Cloud

After completing the configuration, you can verify that Secure Work events are flowing into Splunk Cloud. Events should begin appearing within a few minutes.

Log in to your Splunk Cloud instance.
Run a search query similar to the following:

index="main" source="BI_events_http" actor.tenant_id="TENANT_CONFIGURED"

Appendix

If you are a developer, refer to the Beyond Identity Developer API Guide to learn how to retrieve event types programmatically.

You can access the documentation here:

https://developer.beyondidentity.com/api/v0#tag/Events/operation/getEvents