Integrating Splunk with NordStellar

This guide walks you through connecting NordStellar to Splunk. Once connected, NordStellar sends alert findings such as leaked credentials, malware infections, dark web mentions, and attack surface vulnerabilities into Splunk so your SOC team can search, alert on, and respond to them alongside the rest of your security telemetry.

How the Integration Works

NordStellar publishes the NordStellar app for Splunk (TA-nordstellar). You install it in Splunk, and its setup page generates the two values you need — an API URL and an API key — without you having to create tokens by hand. You then enter those two values in NordStellar, and NordStellar pushes findings to your Splunk instance as JSON events over HTTPS.

Behind the scenes, the API URL is your Splunk HTTP Event Collector (HEC) endpoint and the API key is a HEC token dedicated to NordStellar. The token pins the events to the nordstellar:security:event sourcetype and to the index you choose, and the app ships the parser for that sourcetype — so you don't have to configure parsing, field extraction, or CIM normalization yourself.

At a high level:

1. Install the NordStellar app for Splunk in your Splunk instance.
2. Open the app's setup page, choose a target index, and generate the API URL and API key.
3. Add the Splunk integration in NordStellar and choose which projects and findings to forward.
4. Verify that NordStellar events are arriving in Splunk.

Prerequisites

Before you begin, make sure you have:

• A Splunk Enterprise or Splunk Cloud instance.
• Permissions to install apps in Splunk, and a Splunk user with the edit_httpinputs capability (the admin role has it) — this is required to generate the API key.
• The target index you want NordStellar events written to. It must already exist in Splunk (the default is main).
• Your Splunk HTTP Event Collector endpoint reachable from the internet over HTTPS, so NordStellar can deliver events. On Splunk Enterprise this is usually port 8088.
• Organization Admin permissions in NordStellar.
• Access to the NordStellar organization and projects whose findings you want to send to Splunk.

Step 1: Install the NordStellar App for Splunk

Install the app in the Splunk instance where NordStellar findings should appear.

Step 2: Generate the API URL and API Key

The app's setup page enables the HTTP Event Collector, creates a HEC token dedicated to NordStellar, and shows you the values to copy.

Step 3: Add the Integration in NordStellar

Now return to the NordStellar Platform to create the integration.

Step 4: Verify Data in Splunk

After saving, look for the test event in Splunk. It can then take several minutes for ongoing findings to appear. To confirm data is flowing:

1. In Splunk Web, open Search & Reporting.

2. Search for the NordStellar sourcetype in the index you selected:

   index=<your index> sourcetype="nordstellar:security:event"

3. You should see structured JSON records containing the NordStellar finding details.

The test event carries only a title and description, so it appears with the signature and body fields populated — enough to confirm events are being ingested and parsed. The promoted fields (EventType, RiskLevel, AssetValue, and so on) and the CIM fields populate once real NordStellar findings arrive, since those carry the additional data.

Once real findings are flowing, you can break them down by type:

index=<your index> sourcetype="nordstellar:security:event"
| stats count by EventType

You can now build Splunk alerts, dashboards, and saved searches on top of the NordStellar findings.

Fields and CIM Mapping

The app parses the full NordStellar JSON payload, so every field in an event is searchable. On top of that, it promotes a set of common fields to friendly names and normalizes events onto the Splunk Common Information Model (CIM).

Promoted fields

Detection time and event time

Event time (_time) is the moment Splunk ingested the event, not the moment NordStellar detected the finding. The detection time is preserved separately, in the DetectedAt and DetectionTime fields.

This is deliberate. NordStellar delivers findings whose own dates can be months or years old, and Splunk uses _time to decide which index bucket an event is written to. Backdating events to their detection date would hide newly delivered findings from recent-window searches and scheduled alerts, and could expose them to your index retention settings before you ever see them.

For example, to list findings by how long ago they were actually detected:

index=<your index> sourcetype="nordstellar:security:event"
| eval DaysOld = round((now() - DetectionTime) / 86400)
| eval Detected = strftime(DetectionTime, "%F %T")
| table _time Detected DaysOld EventType RiskLevel AssetValue signature

CIM data models

Events are tagged for the CIM data models they genuinely fit, so CIM-aware dashboards and correlation searches pick them up:

Dark web, data breach, leaked credential, and domain permutation findings have no matching CIM data model, so they are field-normalized and carry the generic alert tag rather than being forced into an unrelated model. Common CIM fields such as severity, signature, dest, user, url, cve, and cvss are populated where the finding provides them.

Troubleshooting

If findings are not appearing in Splunk, review the following:

• The connection test failed when saving:

  • Confirm the API URL and API key in NordStellar exactly match the values on the Splunk setup page.
  • Verify there are no trailing spaces or truncated characters in the pasted API URL or API key.
  • Confirm the API URL is the collector root (ending in /services/collector) with no extra path appended.
  • On Splunk Cloud, confirm you replaced the host with your stack's HEC host.

• You can't generate the API key:

  • Confirm you are signed in to Splunk as a user with the edit_httpinputs capability (the admin role has it).
  • Ask your Splunk administrator to run the setup page if you don't have that capability.

• The setup page warns that the HTTP Event Collector is disabled:

  • Enable it under Settings → Data inputs → HTTP Event Collector → Global Settings. While HEC is disabled, Splunk will not ingest the events NordStellar sends.

• No data after several minutes:

  • Confirm you are searching the same index that was selected when the API key was generated, and that your Splunk role can search it.
  • Confirm the nordstellar token is enabled under Settings → Data inputs → HTTP Event Collector.
  • Check that the index still exists — events sent to a deleted index are dropped.
  • Confirm the integration is enabled in NordStellar.

• Events arrive but fields are missing:

  • Confirm the NordStellar app for Splunk is installed and that Splunk was restarted after installation, since the parser ships with the app.
  • Remember that the test event only populates signature and body. Wait for real findings before judging the field extractions.

• Project scope is too narrow:

  • In NordStellar, confirm that the integration applies to the projects whose findings you expect to see.
  • If you enabled Send existing events, verify that the selected date range includes the findings you are checking.

• Network/Firewall:

  • Confirm there are no restrictions preventing NordStellar from reaching your Splunk HTTP Event Collector endpoint over HTTPS.
  • For on-premises Splunk, confirm the HEC port (8088 by default) is open to inbound traffic from NordStellar.

If you've checked these details and the problem persists, please contact NordStellar support for assistance.