# Streaming Kiteworks Events to Splunk Enterprise via Webhooks

> Forward Kiteworks PubSub events to Splunk Enterprise over HTTPS using the HTTP Event Collector — configure the HEC token, a Kiteworks webhook setting, and an event subscription.

Integrations

# Streaming Kiteworks Events to Splunk Enterprise via Webhooks

Kiteworks emits a continuous stream of system events — file uploads, downloads, folder changes, admin logins, permission changes, and more — through its PubSub event bus. This guide wires that event stream into Splunk Enterprise so those events land in a Splunk index in near real time.

The mechanism is a webhook: Kiteworks PubSub publishes events as JSON payloads over HTTP(S) to a Splunk **HTTP Event Collector (HEC)** endpoint. You control *which* events get forwarded by selecting event categories when you register the webhook — forward everything, or scope it to specific categories.

In this guide

1. [What this integration does](#what-it-does) — the event flow at a glance
2. [Why integrate with Splunk](#why-integrate) — SIEM correlation, audit trail, selective ingestion
3. [Prerequisites](#prerequisites) — Splunk access, Admin console access, and network requirements
4. [Step 1: Enable the HTTP Event Collector](#step-1) — turn on HEC in Splunk
5. [Step 2: Create an HEC token](#step-2) — the token Kiteworks authenticates with
6. [Step 3: Create the Kiteworks webhook setting](#step-3) — point PubSub at Splunk
7. [Step 4: Create a subscription](#step-4) — choose which events forward
8. [Verifying the flow end to end](#verify) — confirm events land in Splunk
9. [Troubleshooting](#troubleshooting) — common issues and fixes
10. [Summary](#summary) — the three pieces, at a glance

## What this integration does

At a high level, the flow is:

- A **Webhook setting** (destination + auth) and a **Subscription** (events + target setting) both configure **Kiteworks PubSub**.
- Kiteworks PubSub delivers the event as an HTTPS POST, JSON, HMAC-signed request to the **Splunk HEC endpoint**.
- Splunk routes the event into a **Splunk index**.

A **webhook setting** tells PubSub *where* to send events and how to authenticate to that destination. A **subscription** binds that setting to one or more event names — or a wildcard — so PubSub knows *which* events to push. Both are configured through the Kiteworks Admin console.

## Why integrate PubSub with Splunk

- **Centralized security monitoring.** Kiteworks activity (file access, sharing, admin actions) shows up alongside your other security telemetry in Splunk, instead of living only in Kiteworks' own logs and UI.
- **Real-time visibility.** Events are pushed as they happen, rather than pulled on a polling schedule, so dashboards and alerts in Splunk reflect near-live activity.
- **SIEM correlation.** Once Kiteworks events are in Splunk, you can correlate them with identity, network, or endpoint data to build detections — e.g. unusual bulk downloads, off-hours admin logins.
- **Compliance and audit trail.** Splunk's retention, search, and reporting can satisfy audit requirements that reference Kiteworks content activity.
- **Selective ingestion.** Webhooks can be scoped to specific event categories, so teams can forward only the events they care about instead of everything — keeping index volume and licensing costs under control.

## Prerequisites

1

A Splunk Enterprise instance you can administer

You'll need Settings access to configure the HTTP Event Collector.

2

Kiteworks Admin console access

You'll need access to **Application Setup > Event Subscriptions** to create the webhook.

3

Network path to the Splunk HEC port

The Kiteworks appliance must reach the Splunk HEC port (default `8088`), with any firewall rules opened.

4

Valid SSL certificates on the Splunk side (recommended)

Required if you plan to serve HEC over HTTPS, which this guide recommends.

## Step 1: Enable the HTTP Event Collector in Splunk

- Log in to your Splunk Enterprise instance.
- Go to **Settings > Data Inputs**.
- Select **HTTP Event Collector**.
- Click **Global Settings** (top right).
- **Configure the collector.** Toggle **All Tokens** to **Enabled**, enable **SSL** so HEC is served over HTTPS rather than HTTP, and set the HEC port (default `8088`).
- Click **Save**.

## Step 2: Create an HEC token

- Still under **Settings > Data Inputs > HTTP Event Collector**, click **New Token**.
- **Fill in the token configuration.** **Name** — e.g. `kiteworks_content_pubsub_integration`. **Description** — e.g. "Kiteworks Content PubSub integration". **Source name override** — a value that lets you distinguish these events in Splunk, e.g. the source server name. **Indexer acknowledgment** (optional) enables reliable, acknowledged delivery — if you turn this on, you must append a `channel` query parameter to the endpoint URI (see the note below).
- Click **Next**, and set the source type to `_json` (Kiteworks PubSub sends JSON payloads).
- Click **Review**, confirm the settings, then **Submit**.
- Copy the generated **token value** — you'll need it as the `Authorization` header value when configuring the Kiteworks webhook.

> The HEC endpoint used for ingestion is `/services/collector/raw`, e.g. `https://<splunk-host>:8088/services/collector/raw`. If indexer acknowledgment is enabled, append a channel parameter: `https://<splunk-host>:8088/services/collector/raw?channel=<channel-guid>`.

## Step 3: Create the Kiteworks webhook setting

In the Kiteworks Admin console, go to **Application Setup > Event Subscriptions** and click **+ Add Webhook URL**. Set the following fields:

| Field | Value |
|---|---|
| **Webhook URL** | Your Splunk HEC raw-collector endpoint, e.g. `https://<splunk-host>:8088/services/collector/raw` |
| **Token** | `Splunk <HEC-token-value>` |

See [PubSub Quick Start](../pubsub-quick-start.html#step-1) for the full field reference, including the Secret field and how the Token header works.

## Step 4: Create a subscription (choose which events to forward)

In the same **Add Webhook URL** dialog, select the **event categories** you want forwarded to Splunk, or check **Subscribe to all events** to forward everything.

See [PubSub Quick Start](../pubsub-quick-start.html#step-1) for more information.

## Verifying the flow end to end

- Trigger an event in Kiteworks that matches the event categories you selected for this webhook — e.g. upload a file if you subscribed to folder/file-related events, or anything if you selected Subscribe to all events.
- In Splunk, search the index associated with your HEC token for recent events, filtering by the source name override you set in Step 2.
- Confirm the JSON payload structure matches what you expect, and that timestamps line up with the action you performed in Kiteworks.

## Troubleshooting notes

### No events are arriving in Splunk

Confirm no firewall is blocking the HEC port (default `8088`) between Kiteworks and Splunk, and that the webhook's **Webhook URL** matches your Splunk HEC endpoint exactly.

### I'm seeing SSL/TLS errors

If using HTTPS, verify certificates are correctly configured. On the Splunk side, HEC input configuration lives in `inputs.conf` under `$SPLUNK_HOME/etc/apps/splunk_httpinput/local/`.

### Indexer acknowledgment is enabled but events fail

Make sure you appended `?channel=<channel-guid>` to the endpoint URI used in the webhook setting — this is required once indexer acknowledgment is turned on for the HEC token.

### I'm getting too many or too few events

Double check which event categories are selected on the webhook in Admin Portal — narrow it to specific categories, or select **Subscribe to all events** to forward everything.

### Having issues with your PubSub configuration

See [PubSub Quick Start](../pubsub-quick-start.html) for additional information.

## Summary

| Component | Role |
|---|---|
| **Splunk HEC token** | Authenticates inbound events and routes them to an index/source type |
| **Kiteworks webhook setting** | Defines *where* PubSub sends events (Webhook URL, Secret, Token) |
| **Kiteworks subscription** | Defines *which* events get sent, via the webhook's event categories |

Once these three pieces are in place, Kiteworks activity flows into Splunk automatically, giving you a live, queryable feed of content events for security monitoring, alerting, and compliance reporting.

## Also see

[PubSub Quick Start

Register a webhook from the Admin Portal UI and receive your first PubSub event in under 15 minutes.](../pubsub-quick-start.html)

[Sentinel Webhooks

Stream Kiteworks events into Microsoft Sentinel using Azure's Logs Ingestion API.](kiteworks-events-to-sentinel-via-pubsub.html)

[API Reference

Full schema reference for all PubSub webhook endpoints — request bodies, response shapes, and error codes.](../api-reference.html#op/post__webhooks)