Splunk

Send alerts, malware logs, and application data from SURF into Splunk using an HTTP Event Collector token.

Before you start

Requirement	Detail
Splunk access	An account that can add data and create HTTP Event Collector tokens
SURF access	Administrator on the SURF Admin console

Step 1: Create the HTTP Event Collector token

Log in to your Splunk instance and select Add data.
Select Monitor.
Select HTTP Event Collector and give the token a name, for example surf-alerts.
Leave the remaining fields as default and continue to the end of the wizard.
Copy the Token Value shown on the confirmation screen.

Step 2: Configure the integration in SURF

In SURF Admin, go to Settings → Integrations and open the Splunk setup.
Complete the dialog:

Field	Value
URL	The URL of your Splunk instance
Token	The HTTP Event Collector token from Step 1
Data to send	Tick the data types required: Alerts, Malware Logs, Applications

Click Submit and enable the integration.

Payload reference

The shapes below are what SURF sends, so you can build searches and dashboards against them.

Alerts

{"policy":"DLP","restrictedResource":"https://example.com/article.html",
 "classificationName":"Print","sourceIp":"20.0.30.191","sourceExternalIp":"78.135.60.164",
 "country":"CY","deviceType":"desktop","deviceAgent":"browser","operatingSystem":"GNU/Linux",
 "client":"user@example.com","group":null,"severity":"info"}

Applications

{ "client": "user@example.com", "domain": "figma.com", "accessCount": 18 }

Download and upload

{"client":"user@example.com","type":"Upload","url":"https://example.com","filename":"test.pdf"}

Malware logs

{
  "url": "www.example.com",
  "blockedUrlCount": 12,
  "blockedClients": [ { "clientId": "d96f0037-24ea-4727-b1ea-f881fa86769a", "blockCount": 13 } ],
  "blockedUrls": [ { "tstamp": 1706865975228, "url": "...", "hostname": "www.example.com",
    "domain": "example.com", "category": "Ad Protection",
    "filter": { "result": 1, "source": "static", "raw": "||example.com/lib/*/advertisement" } } ]
}

Navigation

{"active":true,"dataLoaded":1400,"dataReceived":479,"domain":"cnbc.com","openTabs":8,
 "pendingUrl":"https://www.example.com/article.html","transitionType":"link",
 "url":"https://www.google.com/search","client":"user@example.com"}

Troubleshooting

Symptom	Check
No events arrive	Wrong instance URL, or the HTTP Event Collector is disabled at the Splunk end
Authentication rejected	Token value copied incorrectly, or the token was deleted in Splunk
Some data types missing	The corresponding box was not ticked under Data to send

For anything not covered here, contact the SURF support team.