Splunk

Set up Splunk for automated tests with TrustCloud!

Purpose

Once you set up your compliance program, TrustCloud TrustOps works to ensure that your systems remain compliant with your adopted controls. To do so, TrustCloud runs automated tests against systems in your product and business stack and verifies that they are properly configured.

This document outlines the steps you can take to grant TrustCloud access to only read metadata about the configuration settings for your Splunk instance so that TrustOps can validate and generate evidence for your compliance program.

Instructions to grant TrustCloud limited access to Azure Sentinel

1. Login to your Splunk Cloud console as a user that has an Admin role.
2. Navigate to the Settings tab & then under Users and Authentication, click Tokens.
   
3. Within the Settings page, navigate to the Token Settings section.
   
4. Within the Token Settings section, you need to enable Token Authentication, then specify Default Expiration as never and click Save
   
   
5. Next, click New Token and within the New Token section specify the required fields, then click Create and save the Token in a convenient place for further use when setting up the Integration.
   
6. Determine the host name for your Splunk instance. It will be in your instance URL – https://<host>.splunkcloud.com