Streaming Kiteworks Events to Splunk Enterprise via Webhooks

Kiteworks emits a continuous stream of system events — file uploads, downloads, folder changes, admin logins, permission changes, and more — through its PubSub event bus. This guide wires that event stream into Splunk Enterprise so those events land in a Splunk index in near real time.

The mechanism is a webhook: Kiteworks PubSub publishes events as JSON payloads over HTTP(S) to a Splunk HTTP Event Collector (HEC) endpoint. You control which events get forwarded by selecting event categories when you register the webhook — forward everything, or scope it to specific categories.

What this integration does

A webhook setting tells PubSub where to send events and how to authenticate to that destination. A subscription binds that setting to one or more event names — or a wildcard — so PubSub knows which events to push. Both are configured through the Kiteworks Admin console.

Why integrate PubSub with Splunk

• Centralized security monitoring

  Kiteworks activity (file access, sharing, admin actions) shows up alongside your other security telemetry in Splunk, instead of living only in Kiteworks' own logs and UI.
• Real-time visibility

  Events are pushed as they happen, rather than pulled on a polling schedule, so dashboards and alerts in Splunk reflect near-live activity.
• SIEM correlation

  Once Kiteworks events are in Splunk, you can correlate them with identity, network, or endpoint data to build detections — e.g. unusual bulk downloads, off-hours admin logins.
• Compliance and audit trail

  Splunk's retention, search, and reporting can satisfy audit requirements that reference Kiteworks content activity.
• Selective ingestion

  Webhooks can be scoped to specific event categories, so teams can forward only the events they care about instead of everything — keeping index volume and licensing costs under control.

Prerequisites

Step 1: Enable the HTTP Event Collector in Splunk

1. Log in to your Splunk Enterprise instance.
2. Go to Settings > Data Inputs.
3. Select HTTP Event Collector.
4. Click Global Settings (top right).
5. Configure the collector

   Toggle All Tokens to Enabled, enable SSL so HEC is served over HTTPS rather than HTTP, and set the HEC port (default 8088).
6. Click Save.

Step 2: Create an HEC token

1. Still under Settings > Data Inputs > HTTP Event Collector, click New Token.
2. Fill in the token configuration

   Name — e.g. kiteworks_content_pubsub_integration. Description — e.g. "Kiteworks Content PubSub integration". Source name override — a value that lets you distinguish these events in Splunk, e.g. the source server name. Indexer acknowledgment (optional) enables reliable, acknowledged delivery — if you turn this on, you must append a channel query parameter to the endpoint URI (see the note below).
3. Click Next, and set the source type to _json (Kiteworks PubSub sends JSON payloads).
4. Click Review, confirm the settings, then Submit.
5. Copy the generated token value — you'll need it as the Authorization header value when configuring the Kiteworks webhook.

Step 3: Create the Kiteworks webhook setting

In the Kiteworks Admin console, go to Application Setup > Event Subscriptions and click + Add Webhook URL. Set the following fields:

See PubSub Quick Start for the full field reference, including the Secret field and how the Token header works.

Step 4: Create a subscription (choose which events to forward)

In the same Add Webhook URL dialog, select the event categories you want forwarded to Splunk, or check Subscribe to all events to forward everything.

See PubSub Quick Start for more information.

Verifying the flow end to end

1. Trigger an event in Kiteworks that matches the event categories you selected for this webhook — e.g. upload a file if you subscribed to folder/file-related events, or anything if you selected Subscribe to all events.
2. In Splunk, search the index associated with your HEC token for recent events, filtering by the source name override you set in Step 2.
3. Confirm the JSON payload structure matches what you expect, and that timestamps line up with the action you performed in Kiteworks.

Troubleshooting notes

No events are arriving in Splunk

Confirm no firewall is blocking the HEC port (default 8088) between Kiteworks and Splunk, and that the webhook's Webhook URL matches your Splunk HEC endpoint exactly.

I'm seeing SSL/TLS errors

If using HTTPS, verify certificates are correctly configured. On the Splunk side, HEC input configuration lives in inputs.conf under $SPLUNK_HOME/etc/apps/splunk_httpinput/local/.

Indexer acknowledgment is enabled but events fail

Make sure you appended ?channel=<channel-guid> to the endpoint URI used in the webhook setting — this is required once indexer acknowledgment is turned on for the HEC token.

I'm getting too many or too few events

Double check which event categories are selected on the webhook in Admin Portal — narrow it to specific categories, or select Subscribe to all events to forward everything.

Having issues with your PubSub configuration

See PubSub Quick Start for additional information.

Summary

Once these three pieces are in place, Kiteworks activity flows into Splunk automatically, giving you a live, queryable feed of content events for security monitoring, alerting, and compliance reporting.

Also see