> Source: [sk161974](https://support.checkpoint.com/results/sk/sk161974)

# sk161974 - Configure Splunk as a Log system for CloudGuard 

| Property | Value |
|----------|-------|
| Solution ID | sk161974 |
| Date Created | 2019-09-04 |
| Last Modified | 2023-04-27 |
| Technical Level | General |
| Products | Cloud Firewall |
| Versions | R82.10, R81.20, R82 |

## Solution

This article describes how to configure CloudGuard to send compliance findings to Splunk. This involves the configuration of an HTTP Event Collector on your Splunk instance and the configuration of a Posture Notification on CloudGuard.  

There are many ways to configure Splunk Event Collectors (see [Splunk Documentation](https://docs.splunk.com/Documentation/SplunkCloud/8.0.2006/Data/UsetheHTTPEventCollector) for details). The steps below describe a typical case, for Splunk Cloud.

Configure a HTTP Event Collector on Splunk (Cloud)
--------------------------------------------------

1. On your Splunk instance, navigate to **Settings** and select **Data Input**.
2. In the **Local inputs** list, select **HTTP Event Collector**.
3. Click **New Token**on the upper right.
4. Enter a name for the event collector and click **Next**.
5. In the **Input Settings** , select the 'main' index in the Index section, then click **Review**.
6. Click **Submit**.
7. Copy the **Token Value** .  

   ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk161974/Splunk-token1909040302.png)

Configure a CloudGuard Notification
-----------------------------------

1. In the CloudGuard portal, navigate to **Notifications** in the **Settings** menu.
2. Click **Add Notification**.
3. Enter a name \& description for the policy.
4. Select *Send to HTTP Endpoint* in the **Immediate Notification** section,(**Notifications to HTTP** endpoints are issued from one of these fixed IP addresses: **3.232.156.115** , **52.70.61.156** , or **3.231.193.67**).
5. Copy the URL of your Splunk instance and enter this in the Endpoint URL field. Click **Test** to verify the connection.  
   ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk161974/NotPolicySplunk202007201357091.png)  

6. From the **Authentication Type** list, select **Basic**.
7. Paste the Splunk token from the previous section in the **Password**field and enter any value for the Username.
8. Select **Splunk - JSON**.
9. Select the option to use self-signed certificates.  
   ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk161974/splunk-self-sign-cert202007201228301.png)
10. Click **SAVE**.

Configure CloudGuard Continuous Posture Policies to Use the Notification
------------------------------------------------------------------------

To send findings to Splunk with the integration described above, the CloudGuard Notification must be associated with a Continuous Posture Policy. Follow the steps below to do this. Once this is done, findings discovered by this posture policy are sent to Splunk as soon as they are discovered (findings already sent from an earlier CloudGuard policy assessment will be not sent again).

1. In the CloudGuard portal, navigate to **Continuous Posture** in the **Posture Management**menu.
2. If you already have a continuous posture policy and want to send its findings to Splunk, click the menu in the leftmost column and select **Edit Policy** .  
   ![](https://sc1.checkpoint.com/sc//SolutionsStatics/sk161974/sk161974-edit-policy202108111055011.png)
3. Select the Notification Policy created above and click **SAVE** .  
   ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk161974/Splunk-select-notification-policy1909040335.png)
4. Alternatively, **ADD POLICY** to create a new policy. Follow the steps in the [CloudGuard Administration Guide](https://sc1.checkpoint.com/documents/CloudGuard_Dome9/Default.htm#cshid=continuous_posture) to create the policy. Select the Notification created above as one of the notifications.  

   **Note:** To send previously found findings to Splunk, select the Policy in the list on the **Continuous Posture** page, click the menu and select **Send all alerts**.

View Findings on Splunk
-----------------------

All new findings for this policy will be sent to Splunk.

1. Select **Search \& Reporting** in the main Apps menu.  
   ![](https://sc1.checkpoint.com/sc//SolutionsStatics/sk161974/Splunk-search-and-reporting1909040410.png)
2. Click **Data Summary** .  
   ![](https://sc1.checkpoint.com/sc//SolutionsStatics/sk161974/Splunk-Data-Summary1909040412.png)
3. Click the link for your instance, for a list of CloudGuard findings. Count shows the total number of findings.  
   ![](https://sc1.checkpoint.com/sc//SolutionsStatics/sk161974/Splunk-data-summary-link1909040414.png)  
   The list shows each finding as a JSON block.  
   ![](https://sc1.checkpoint.com/sc//SolutionsStatics/sk161974/Splunk-findings1909040416.png)

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content