Add-on Tabs for Splunk – Bitsight Knowledge Base

The following Bitsight data are available as tabs in Splunk through the Bitsight and Splunk integration:

Inputs

Configure your add-on to connect with the Bitsight platform. You will need to provide the following information:

Name: The name of this configuration set.
Interval: How often the Bitsight data should be pulled (measured in seconds). This setting should be left as is, as the Bitsight ratings and ratings data are refreshed once per day.

Default: 86400 seconds (once per day).
Index: The index where Bitsight data is logged.
API Token: Your Bitsight API token.

Create an API token specifically for use in the Splunk application, as opposed to a specific user token. This ensures the token can be used without breaking existing integrations if the user account is deleted. Create an email alias specifically for the integration and generate a token leveraging this email alias to ensure the integration does not depend on a specific user’s email address.

View the prebuilt Splunk dashboard panels with Bitsight observations.

Correlate Bitsight data with Splunk data.

Use the Splunk search capability in conjunction with Bitsight to monitor issues with remote users connected to your network.