Red Hat Summit Red Hat Summit지원콘솔개발자평가판 시작연락처

14장. Integrating with Splunk

If you are using Splunk, you can forward alerts from Red Hat Advanced Cluster Security for Kubernetes to Splunk and view the violations, vulnerability detection, and compliance related data from within Splunk.

중요

Currently, Splunk integration is not supported on IBM Power(ppc64le) and IBM Z(s390x).

Depending on your use case, you can integrate Red Hat Advanced Cluster Security for Kubernetes with Splunk by using the following ways:

You can use one or both of these integration options to integrate the Red Hat Advanced Cluster Security for Kubernetes with Splunk.

14.1. Using the HTTP event collector
링크 복사

You can forward alerts from Red Hat Advanced Cluster Security for Kubernetes to Splunk by using an HTTP event collector.

To integrate Red Hat Advanced Cluster Security for Kubernetes with Splunk by using the HTTP event collector, follow these steps:

  1. Add a new HTTP event collector in Splunk and get the token value.
  2. Use the token value to set up notifications in Red Hat Advanced Cluster Security for Kubernetes.
  3. Identify policies for which you want to send notifications, and update the notification settings for those policies.

14.1.1. Adding an HTTP event collector in Splunk
링크 복사

Add a new HTTP event collector for your Splunk instance, and get the token.

Procedure

  1. In your Splunk dashboard, go to Settings Add Data.
  2. Click Monitor.
  3. On the Add Data page, click HTTP Event Collector.
  4. Enter a Name for the event collector and then click Next >.
  5. Accept the default Input Settings and click Review >.
  6. Review the event collector properties and click Submit >.
  7. Copy the Token Value for the event collector. You need this token value to configure integration with Splunk in Red Hat Advanced Cluster Security for Kubernetes.

14.1.1.1. Enabling HTTP event collector
링크 복사

You must enable HTTP event collector tokens before you can receive events.

Procedure

  1. In your Splunk dashboard, go to Settings Data inputs.
  2. Click HTTP Event Collector.
  3. Click Global Settings.
  4. In the dialog that opens, click Enabled and then click Save.

14.1.2. Configuring Splunk integration in Red Hat Advanced Cluster Security for Kubernetes
링크 복사

Create a new Splunk integration in Red Hat Advanced Cluster Security for Kubernetes by using the token value.

Procedure

  1. In the RHACS portal, go to Platform Configuration Integrations.
  2. Scroll down to the Notifier Integrations section and select Splunk.
  3. Click New Integration (add icon).
  4. Enter a name for Integration Name.
  5. Enter your Splunk URL in the HTTP Event Collector URL field. You must specify the port number if it is not 443 for HTTPS or 80 for HTTP. You must also add the URL path /services/collector/event at the end of the URL. For example, https://<splunk-server-path>:8088/services/collector/event.

  6. Enter your token in the HTTP Event Collector Token field.

    참고

    If you are using Red Hat Advanced Cluster Security for Kubernetes version 3.0.57 or newer, you can specify custom Source Type for Alert events and Source Type for Audit events.

  7. Select Test to send a test message to verify that the integration with Splunk is working.
  8. Select Create to generate the configuration.

14.1.3. Configuring policy notifications
링크 복사

Enable alert notifications for system policies.

Procedure

  1. In the RHACS portal, go to Platform Configuration Policy Management.
  2. Select one or more policies for which you want to send alerts.
  3. Under Bulk actions, select Enable notification.

  4. In the Enable notification window, select the Splunk notifier.

    참고

    If you have not configured any other integrations, the system displays a message that no notifiers are configured.

  5. Click Enable.
참고
  • Red Hat Advanced Cluster Security for Kubernetes sends notifications on an opt-in basis. To receive notifications, you must first assign a notifier to the policy.
  • Notifications are only sent once for a given alert. If you have assigned a notifier to a policy, you will not receive a notification unless a violation generates a new alert.

  • Red Hat Advanced Cluster Security for Kubernetes creates a new alert for the following scenarios:

    • A policy violation occurs for the first time in a deployment.
    • A runtime-phase policy violation occurs in a deployment after you resolved the previous runtime alert for a policy in that deployment.
Red Hat logoGithubredditYoutubeTwitter

자세한 정보

평가판, 구매 및 판매

커뮤니티

Red Hat 소개

Red Hat은 기업이 핵심 데이터 센터에서 네트워크 에지에 이르기까지 플랫폼과 환경 전반에서 더 쉽게 작업할 수 있도록 강화된 솔루션을 제공합니다.

보다 포괄적 수용을 위한 오픈 소스 용어 교체

Red Hat은 코드, 문서, 웹 속성에서 문제가 있는 언어를 교체하기 위해 최선을 다하고 있습니다. 자세한 내용은 다음을 참조하세요.Red Hat 블로그.

Red Hat 문서 정보

Red Hat을 사용하는 고객은 신뢰할 수 있는 콘텐츠가 포함된 제품과 서비스를 통해 혁신하고 목표를 달성할 수 있습니다. 최신 업데이트를 확인하세요.

Legal Notice

Theme

© 2026 Red Hat맨 위로 이동