- Overview
- Reference Guide
- Setup & Architecture
- Release Notes
- Workflow
- API Reference
- Integration Guide
- Discovery Agent Setup Guide
SEIM Tools
CertSecure’s SIEM Tool section provides users with a seamless integration option to push Certificate Lifecycle Management (CLM) logs directly into a Security Information and Event Management (SIEM) platform. This ensures real-time visibility, monitoring, and centralized management of certificate events such as issuance, renewal, revocation, and failures across the enterprise environment. Currently, CertSecure Manager offers native integration with Splunk as part of the SIEM Tools ecosystem.
Splunk Integration
The Splunk Integration within CertSecure enables organizations to forward certificate lifecycle logs into their Splunk environment through a configurable HTTP Event Collector (HEC) connection. This allows security and operations teams to correlate certificate activities with enterprise security events, helping with compliance, auditing, and threat detection.
Users can configure the Splunk integration directly from the CertSecure UI by providing the following parameters:
- Protocol: HTTP or HTTPS connection type
- HEC Host: Hostname of the Splunk HTTP Event Collector (for example, splunk.company.com).
Enter the hostname only, without https://, a port, or a path. On a paid Splunk Cloud stack, the HEC host
is usually a different hostname from the one used to log in to Splunk (http-inputs-
.splunkcloud.com). - Port: Splunk HEC port (default: 8088)
- HEC Token: HEC token generated in the Splunk environment (Settings → Data Inputs → HTTP Event Collector). The token is required when Splunk is configured for the first time. For security, the saved token is never displayed; when updating an existing configuration, leave this field blank to keep the current token, or enter a new token to replace it.
- Index: Name of the Splunk index that receives the logs (for example, certsecure_logs). This field is required. The index must already exist in Splunk and the HEC token must be allowed to write to it; neither CertSecure nor Splunk HEC creates it.
- Forward logs to Splunk: Option to enable or disable automatic log forwarding to Splunk
Before a configuration can be saved, users must test the Splunk connection from within the configuration panel using Test Splunk. The test checks the values currently entered in the form, not the previously saved configuration, and sends a test event to the selected index. When the test succeeds, the index that received the event is displayed and the Save button is enabled.
If the test fails, a message describes what to check, such as an unreachable host, an unhealthy HEC endpoint, or an index that Splunk rejected. Changing any field after a successful test disables Save until the connection is tested again.
To stop forwarding logs for an existing configuration, switch off Forward logs to Splunk and click Save. No connection test is required in this case, so forwarding can be turned off even when Splunk is unreachable or the HEC token has been revoked. A first-time configuration always requires a successful test before it can be saved.
CertSecure Manager periodically synchronizes the CLM logs based on internal refresh cycles and pushes new logs to Splunk, ensuring near real-time updates. A “Last Synced” timestamp is also displayed for transparency.
Note: This integration provides a centralized view of certificate activities within the existing SIEM infrastructure, enhancing operational efficiency and security monitoring.