Splunk HEC

The Splunk sink delivers Alphyn events to the Splunk HTTP Event Collector (HEC) over HTTPS. Each event is posted as the canonical Alphyn Security Event JSON under sourcetype alphyn:security, ready for search, dashboards, and correlation searches in Splunk Enterprise or Splunk Cloud.

Configure it in the Alphyn dashboard under Integrations, using integration key splunk_hec.

Configuration

Field	Required	Description
url	Yes	The Splunk HEC event endpoint, for example https://splunk.acme.com:8088/services/collector/event.
token	Yes	The HEC token authorizing the input.
ca_cert	No	PEM certificate used to pin and validate the HEC endpoint’s TLS chain.

Event format

Alphyn posts a HEC event envelope. The event field holds the canonical Alphyn Security Event JSON, and fields carries indexed metadata for fast filtering:

{
  "time": 1752658881.88,
  "sourcetype": "alphyn:security",
  "fields": {
    "tenantId": "acme",
    "severity": "CRITICAL",
    "eventType": "ROOT-V1",
    "eventFamily": "THREAT"
  },
  "event": {
    "id": "evt_8f21a0",
    "family": "THREAT",
    "module": "ROOT",
    "signatureId": "ROOT-V1",
    "name": "Root detected",
    "severity": "CRITICAL",
    "description": "Root management binary present",
    "deviceId": "dev_5521",
    "package": "com.acme.banking",
    "appVersion": "4.8.1",
    "appHash": "9ad1f0c4",
    "os": "Android 14",
    "sourceIp": "203.0.113.24",
    "tenantId": "acme",
    "occurredAt": "2026-07-16T09:41:21.880Z"
  }
}

Audit events use the same envelope with eventFamily set to AUDIT and an audit-shaped event object (actor, resource, and category fields in place of the device fields).

Setup on the Splunk side

1. In Splunk, go to Settings > Data inputs > HTTP Event Collector and create a new token for Alphyn. Enable the token and, if global HEC is disabled, enable it under Global Settings.
2. Set the token’s allowed sourcetype to include alphyn:security, and select the target index for the events.
3. Note the HEC endpoint URL, including scheme, host, and HEC port (default 8088), ending in /services/collector/event.
4. If you want Alphyn to pin the endpoint’s TLS chain, export the issuing CA certificate as PEM for the ca_cert field.
5. In the Alphyn dashboard, add a Splunk HEC integration, enter url, token, and optional ca_cert, and set the delivery filter.
6. Click Test connection to deliver a synthetic event, then confirm it appears in Splunk with sourcetype=alphyn:security.

Example searches

Events over time by severity:

index=* sourcetype=alphyn:security
| timechart count by severity

Top detection modules across your device fleet:

index=* sourcetype=alphyn:security eventFamily=THREAT
| stats count by module
| sort - count

Device-flag events only:

index=* sourcetype=alphyn:security eventType=DEVICE_FLAGGED
| table _time, tenantId, deviceId, package, os

A ready-to-import Splunk dashboard covering these panels is available: splunk-alphyn-security.xml. Import it under Dashboards > Create New Dashboard > Source and paste the Simple XML, or place the file in your app’s local/data/ui/views directory.