Splunk

Overview#

QuantaSeal sends audit logs and security events to Splunk using the HTTP Event Collector (HEC) endpoint. HEC tokens are sealed in QuantaVault. Every vault operation, encryption event, and compliance check is automatically forwarded to your Splunk index.

Prerequisites#

• 1A Splunk instance (Cloud or Enterprise)
• 2HTTP Event Collector (HEC) enabled with a token
• 3HEC endpoint URL

Configuration#

Follow these steps to connect Splunk to QuantaSeal. You can configure integrations via the Admin Console or directly via the API.

1. 1

   In Splunk, go to Settings → Data Inputs → HTTP Event Collector → New Token.

2. 2

   Enable indexer acknowledgement and set the source type to _json.

3. 3

   Copy the HEC token.

4. 4

   Seal: POST /api/v2/vault/seal with credential_type: api_key.

5. 5

   Create integration with system_type: splunk, config: {hec_url: 'https://splunk.example.com:8088'}.

Authentication Types#

Seal the HEC token as api_key. Include the full HEC endpoint URL in integration config.

All credential types are sealed in QuantaVault with ML-KEM-768 + AES-256-GCM and wrapped by your tenant AWS KMS CMK before storage. See the Vault API reference for the full list of credential types and seal/unseal endpoints.

Available Operations#

QuantaSeal enforces a default-deny operation policy. Only operations listed in your integration's allowed_operations array will be permitted. Add operations when creating or updating the integration.

Code Example#

Every proxy call returns a HybridCryptoEnvelope - the response is ML-KEM-768 key-encapsulated, AES-256-GCM encrypted, and signed with ML-DSA-65 + HMAC-SHA-512. Verify both signatures before trusting the decrypted payload.

curl -X POST https://api.quantaseal.io/api/v2/proxy/outbound \
  -H "X-API-Key: qs_live_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{"integration_id":"int_SPLUNK001","operation":"send_event","payload":{"event":{"action":"vault.seal","tenant":"acme","credential_type":"oauth2_client"},"sourcetype":"quantaseal:audit","index":"security"}}'

Troubleshooting#