Hi everyone. I'm setting up a new security monitoring pipeline and need to integrate NordLayer's logs into our Splunk instance. The goal is to get user connection events and admin actions for auditing.
I found the HTTP Event Collector (HEC) method in NordLayer's admin panel, but the documentation is a bit high-level for me. Could someone share a concrete example of the Splunk `inputs.conf` or `props.conf` configuration they used? I'm especially unsure about the sourcetype and making sure the JSON parses correctly.
Also, does the log format from NordLayer include the `src_ip` field by default, or do I need to add a custom transform to extract it? Any gotchas to watch for? 😅
Here's the HEC token setup I have so far in the NordLayer dashboard:
```json
{
"splunk_hec_endpoint": "https://our-splunk-server:8088/services/collector",
"splunk_hec_token": "************",
"events_to_send": ["connection_events", "admin_events"]
}
```