Splunk Enterprise

Overview

The Splunk Enterprise integration connects your self-hosted Splunk Enterprise instance to Oneleet, syncing the users of the instance as user account assets. This lets Oneleet monitor who has access to your Splunk Enterprise instance.

What does Oneleet monitor?

• Splunk Enterprise users (user accounts), including each user’s roles and authentication type

Setup

To set up the Splunk Enterprise integration, navigate to Integrations > Add integration > Splunk Enterprise.

Oneleet connects with a Splunk authentication token and the address of your instance’s REST API. Sign in to Splunk Web as an admin.

1. Copy the host name and management port of your instance’s REST API without https://, e.g. splunk.example.com:8089. Oneleet must be able to reach it over the internet, and it must serve a TLS certificate from a publicly trusted certificate authority.
2. In Settings → Roles, create a role, e.g. inventory_reader, with only the list_all_users capability. Splunk adds a few default capabilities to new roles, so edit the role after creating it and clear everything except list_all_users.
3. In Settings → Users, create a user, e.g. inventory-reader, that holds only that role.
4. In Settings → Tokens, enable token authentication if needed, then create a token for that user and copy it.
5. Paste both values into the form in Oneleet and click Connect.

Note: Splunk Enterprise doesn’t expose per-user MFA, and its sign-in settings (SAML, LDAP, Duo or RSA MFA) can only be read with the change_authentication capability, which also allows changing them. Oneleet doesn’t request it, so it doesn’t monitor how users sign in.