Forwarding events to Splunk

Forescout Cloud can forward Indicator and Detection events to Splunk™.

Prerequisite: You have obtained the Forescout Splunk DataForwarder application tar file from your Forescout representative.

To enable this feature, complete the following task list (these procedures assume familiarity with the Splunk UI and CLI, administrator access, and are derived from vendor documentation):

  1. Generate a Forescout Cloud Query Service API Key.
  2. Optional - Configure SSL Certificates for the Splunk Management Port 8089 (Splunk Documentation) .
  3. Create Splunk Indexes and Install the Application Package.