Sycope supports External Destinations based on REST, allowing selected alerts to be sent to third-party HTTP endpoints manually or automatically as part of a rule action. Splunk provides the HTTP Event Collector (HEC) for receiving events over HTTP or HTTPS.
This creates a straightforward integration path in which Sycope remains responsible for network analysis and detection, while selected alert information becomes available in Splunk together with data from other security and infrastructure sources.
Table of Contents
From a Sycope alert to Splunk
The Sycope–Splunk integration is supported by the TA-sycope Technology Add-on, which provides the Splunk-side components required to receive, normalize and analyze Sycope data.
The add-on includes native mappings to the Splunk Common Information Model (CIM), including the Intrusion Detection and Network Traffic data models, as well as lookup tables and six ready-to-use dashboards. These include views for analyzing Sycope events in Splunk and a dashboard based on the MITRE ATT&CK matrix.
TA-sycope is installed in the standard Splunk application directory under $SPLUNK_HOME/etc/apps, allowing teams to use a predefined data model, field mappings and visualization layer instead of building the Splunk side of the integration from scratch.
On the Sycope side, alerts can be sent to Splunk through an External Action. The action can be executed manually from an active alert or assigned to a Sycope rule and triggered automatically for selected threshold levels.
Alert data is transferred through the Splunk HTTP Event Collector (HEC). Because Sycope sends the alert as raw JSON without the {“event”: …} wrapper expected by the standard event endpoint, the integration must use:
/services/collector/raw
rather than:
/services/collector/event
HEC authentication also requires the Splunk-specific authorization header:
Authorization: Splunk <token>
A standard Bearer authentication header should not be used for this connection.
Once the event is received, TA-sycope handles the Splunk-side field extraction and normalization and makes the data available for searches, CIM-based analysis, lookup enrichment and the dashboards included with the add-on.
This allows Sycope network and security detections to become part of the existing Splunk workflow while Sycope remains the source of detailed network analysis and historical traffic context.
Complementary capabilities, clearly divided
Sycope and Splunk remain independent systems and cover different parts of the monitoring and security workflow.
Sycope provides:
- Flow-based network analysis
- Host-to-host communication visibility
- Network performance monitoring
- Network anomaly and threat detection
- Predefined and custom alerting rules
- Historical network communication data
- Detailed network context for investigation
Splunk provides:
- Centralized event ingestion and indexing
- Search across multiple data sources
- Dashboards and reporting
- Correlation with other operational and security information
- Existing SOC and SIEM workflows
Sycope identifies activity visible in network traffic and provides the context required to investigate it. Splunk allows selected Sycope events to be handled alongside information collected from other systems.
Sycope detections as part of the wider security picture
The main value of the integration is not simply forwarding another alert into Splunk. It is making selected network detections available where analysts already work with data from multiple parts of the environment.
Network context alongside other security events
A Sycope detection may relate to communication between internal systems, an unexpected external connection, scanning activity, unusual traffic behavior or another network condition.
Sending that event to Splunk allows the detection to be reviewed together with information from other sources covering the same systems and time period.
The Sycope alert provides the network perspective, while Splunk can place it within the broader collection of security and operational events available to the organization.
Using existing Splunk workflows
Organizations that already use Splunk as a central point for security monitoring can include selected Sycope alerts without requiring analysts to monitor every source independently.
The incoming event can be indexed using a dedicated source, sourcetype or index according to the organization’s Splunk configuration. This makes it possible to distinguish Sycope data from other sources and incorporate it into existing searches and dashboards.
The objective is to make relevant Sycope detections available to the existing SOC workflow while keeping detailed traffic analysis in Sycope.
Controlling which events are sent
Not every Sycope alert needs to be forwarded to Splunk.
External Actions can be assigned to selected rules and threshold levels, allowing teams to determine which events should leave the Sycope environment.
This makes it possible to send higher-priority security events or alerts relevant to a particular SIEM workflow while leaving other monitoring information available only in Sycope.
The payload can also be adapted to include the fields required by the Splunk use case rather than transferring unnecessary information.
How the integration works
The integration is based on three main elements.
Splunk HTTP Event Collector
HEC is enabled in the Splunk environment and configured with a token for receiving events.
The HEC configuration determines how incoming data should be indexed and can define values such as the target index and sourcetype. Splunk supports event ingestion through HTTP/S using structured JSON payloads.
External Destination in Sycope
The Splunk endpoint is configured as a REST-based External Destination in Sycope.
Sycope External Destinations support HTTP POST requests and custom payloads for third-party integrations. Dynamic values from active alerts can be included in those payloads, allowing information from the triggered rule to be sent to the receiving system.
The exact Splunk HEC authentication and payload configuration should be adapted to the Splunk environment and its HEC settings.
Manual or automatic alert delivery
The configured destination can be used manually from an active Sycope alert or assigned as an action to a rule.
With automatic delivery, the selected rule and threshold levels determine when Sycope sends an event to Splunk.
This provides control over which network detections become part of the Splunk data set and allows the integration to be aligned with existing SOC processes.
From network detection to SIEM analysis
Consider a Sycope rule that detects network behavior requiring security investigation.
When the configured threshold is reached, Sycope generates the alert and sends the selected event information to the Splunk HEC endpoint.
Splunk indexes the event together with data already collected from other systems. The analyst can use the Sycope detection as another source of evidence when reviewing activity involving the affected hosts or the same time period.
When deeper network analysis is required, the investigation can continue in Sycope using the available traffic history and communication context.
The integration therefore allows Sycope network detections to participate in the wider SIEM process while preserving the role of Sycope as the platform responsible for network analysis.
Sycope and Splunk integration
The integration provides a REST-based way to include selected Sycope alerts in Splunk.
Network and security detections generated by Sycope can be delivered through Splunk HTTP Event Collector and used alongside other operational and security events, while detailed traffic analysis remains available in Sycope.
To discuss integrating Sycope alerts with your Splunk environment, contact our team.
