Splunk HEC

Point HEC-speaking products at XenXDR without rewriting them.

Endpoint

The deployment exposes an HTTP Event Collector compatible listener. In the sending product, set the HEC URL to the deployment's HEC listener and use the ingest key as the HEC token. Both the /services/collector and /services/collector/event paths are accepted.

Fields

HEC envelopes carry event, time, host, source, sourcetype and index. XenXDR maps time to @timestamp, host to host.name, sourcetype to event.module where a mapping exists, and keeps the rest under fields. Known source types, for example common firewall and web server types, are normalised further.

Tenancy

A per-organization ingest key as the HEC token stamps the organization. The deployment-wide shared key lands in the default organization.

Acknowledgements

The listener returns HEC-style acknowledgements so that senders configured with indexer acknowledgement keep working.