Skip to content
Cisco AI Defense logo
CiscoAI Security

Splunk app — DefenseClaw

Overview

DefenseClaw ships Splunk-oriented assets under the repository's observability/deploy tree and emits Splunk-ready data through two code paths:

  • splunk-hec audit sink, configured through defenseclaw setup observability add splunk-hec.
  • gateway.jsonl, tailed by Splunk Universal Forwarder with sourcetype defenseclaw:gateway.

HEC sink setup

defenseclaw setup observability add splunk-hec \
  --non-interactive \
  --host splunk.example.com \
  --port 8088 \
  --index defenseclaw \
  --source defenseclaw \
  --sourcetype _json \
  --token "$DEFENSECLAW_SPLUNK_HEC_TOKEN"

The writer stores the token in ~/.defenseclaw/.env and writes an audit_sinks[] entry with kind splunk_hec.

Universal Forwarder setup

[monitor:///home/defenseclaw/.defenseclaw/gateway.jsonl]
sourcetype = defenseclaw:gateway
index = defenseclaw

[monitor:///home/defenseclaw/.defenseclaw/gateway.jsonl.*.gz]
sourcetype = defenseclaw:gateway
index = defenseclaw

gatewaylog.Writer emits line-delimited JSON, so Splunk field extraction can use normal JSON parsing.

What to search

QuestionSearch starting point
Recent blocked guardrail decisionsindex=defenseclaw severity=HIGH OR severity=CRITICAL
Sink delivery failuresindex=defenseclaw event_type=error subsystem=sinks
Webhook cooldown suppressionindex=defenseclaw code=WEBHOOK_COOLDOWN
Audit export validationdefenseclaw-gateway audit export --include-activity --limit 100

Related