Skip to main content
Splunk Enterprise Security can forward notable events to Calseta via webhook alert actions. Calseta normalizes Splunk’s event format for agent consumption.

​
Ingestion Endpoint

​
Setting Up the Webhook

​
Alert Action Configuration

  1. In Splunk, open the correlation search or saved search you want to forward
  2. Under Trigger Actions, add a Webhook action
  3. Configure:
    • URL: https://your-calseta-host/v1/ingest/splunk
    • Add custom headers via a props.conf/transforms.conf setup, or use a custom alert action script
For more control over the payload format and authentication:
  1. Create a custom alert action script that POSTs to Calseta
  2. Include the Authorization: Bearer cai_your_api_key header
  3. Format the payload as JSON with the relevant search result fields

​
Payload Format

Key field mappings:

​
Severity Mapping

​
Indicator Extraction

The Splunk plugin extracts indicators from:
  • src_ip, dest_ip, src, dest — IP addresses
  • user, src_user, dest_user — account indicators
  • url, domain — URL and domain indicators
  • file_hash, md5, sha1, sha256 — file hash indicators
  • Custom field mappings against raw_payload

​
Webhook Signature Verification

Set SPLUNK_WEBHOOK_SECRET in your .env file. Configure HMAC signing in your Splunk webhook action or custom alert action script.

​
Example Payload

Splunk’s webhook alert action sends search results as the payload. Structure your search to include the fields Calseta needs for indicator extraction — src_ip, dest_ip, user, etc.

​
API Reference

See Ingest Alert for the full endpoint documentation.