Configure HCP Vault Dedicated audit log streaming to Splunk
Availability
HCP Vault Dedicated audit logs streaming is available for all production grade clusters. The feature is not available for Development tier clusters.
Prerequisites
To configure audit logs streaming to Splunk, you will need to have:
Have access to a paid Splunk Cloud or Enterprise account.
Note
Splunk Cloud Trial account would not work with HCP Vault Dedicated as its HEC (HTTP Event Collector ) listener is hosted using a self signed certificate that HCP won't trust.
Your Splunk HEC and token.
Note
HEC endpoint should be created using
events
and notmetrics
index in Splunk.A HCP account with Admin or Contributor role assigned in HCP
A production grade HCP Vault Dedicated cluster
Note
If you do not have a cluster running, refer to the Create a Vault Cluster on HCP or the Deploy HCP Vault Dedicated with Terraform tutorial to create an HCP Vault Dedicated cluster.
Enable audit logs streaming
From the HCP Vault Dedicated cluster Overview page, select the Audit Logs view.
Click Enable Streaming.
From the Enable audit logs streaming view, select Splunk as the provider and click Next.
Under Splunk configuration, enter your HTTP Event Collector (HEC) Endpoint URL and event collector Token.
Click Save.
Note
At this time HCP Vault Dedicated only supports audit log streaming to one log endpoint at a time.
Refer to the Splunk documentation for instructions on log querying.
Example Terraform configuration (optional)
Refer to the Terraform Registry hcp_vault_cluster
documentation
for more information.
Edit the audit log streaming configuration (optional)
To edit a audit log streaming integration, perform the following steps.
From the Audit Logs page, click on the Manage drop-down, then Edit configuration.
Edit the configuration, then click Save.
Disable audit log streaming (optional)
To disable a audit log streaming integration, from the Audit Logs page, click on the Manage drop-down, then Disable streaming.