Skip to content
Maskflare
Talk to usStart free trial
Menu

Splunk integration

Send Maskflare events to Splunk

Add a Splunk HTTP Event Collector endpoint in the Maskflare console to stream blocked requests, policy changes and a per-request event feed, metadata only.
Start free trial Admin console
What it does
  • Blocked requests, blocked files, malicious files and spikes in blocked requests
  • Configuration, API key and policy changes, including policy change proposals and decisions
  • Device unprotected, API key expiring and pending invitation notices, and a weekly digest
  • Request processed: one event per AI request of any outcome, for a SIEM feed

Security teams want AI activity in the SIEM they already watch: which requests were blocked, which policies changed, and how much sensitive data is being masked, by whom and where.

Maskflare has a Splunk destination type. Each event is delivered as one Splunk HEC event with sourcetype maskflare, signed and retried. The event feed carries metadata and counts. It never carries prompts, responses or the values that were detected.

What it does

Set up Splunk with Maskflare

Maskflare posts each event to your Splunk HTTP Event Collector as one HEC event, with your HEC token. Events carry metadata and counts only.

  1. In Splunk, enable the HTTP Event Collector (Settings, Data inputs, HTTP Event Collector, Global Settings) and create a token with New Token. Choose the index for the events. Leave indexer acknowledgment off, because Maskflare does not send a channel ID.
  2. Make sure your HEC URL is reachable from the internet over HTTPS. Maskflare accepts only https:// URLs that resolve to a public address, and refuses private, loopback and internal ones. Splunk Cloud shows its own HEC URL in its documentation.
  3. In the Maskflare console, open Connections, then Integrations and select Add endpoint.
  4. Set Destination to Splunk HTTP Event Collector, URL to your collector, for example https://splunk.example.com:8088/services/collector/event, and HEC token to the token you created. It is stored encrypted and never shown again.
  5. Under Events, tick what to send. For a SIEM feed, tick Request processed and the alert events you care about, such as Request blocked, File blocked, Block spike and Malicious file. For Request processed, set Max events per minute (the default is 6000).
  6. Select Add endpoint. Copy the signing secret if you want to verify signatures (it is shown once), then select Done.
  7. On the endpoint row, select Send test event and check that it arrives in Splunk. Select Deliveries to see recent attempts and any error.
What one event looks like in Splunk
{
  "time": 1762243200.123,
  "source": "maskflare",
  "sourcetype": "maskflare",
  "event": {
    "id": "5f0c...",
    "type": "request.blocked",
    "created_at": "2026-11-04T08:00:00+00:00",
    "organization": "acme",
    "data": { "environment": "production", "provider": "openai", "reason": "sensitive_data" }
  }
}

What data is shared

Good to know

  • Request processed can produce one event for every AI request. Over the per-minute limit, events for that endpoint are dropped and counted, and the console shows the number dropped. Block alerts are never dropped by the limit.
  • Deliveries are at least once. A retry resends the same body, so deduplicate on the event id. Failed deliveries are retried up to six attempts in all, with growing delays.
  • Each delivery is also signed. The Maskflare-Signature header holds a timestamp and an HMAC-SHA256 of the body, which you can check at a proxy in front of Splunk if you want to.
  • Maskflare reaches Splunk from the internet, so a Splunk Enterprise HEC on a private network needs a public HTTPS front such as a load balancer or relay.

Vendor documentation

Frequently asked questions

Does Maskflare send prompts to Splunk?

No. Events carry metadata and counts only. Prompts, responses, file contents and detected values are never in an event.

Can we get one event per AI request?

Yes. Tick Request processed on the endpoint. It is intended for a SIEM, is limited per minute, and is available for Splunk, Microsoft Teams and the HTTPS endpoint, not for Slack or PagerDuty.

Which Splunk token do I need?

A HEC token. Paste it into the HEC token field of the endpoint. Maskflare sends it as the Authorization: Splunk header and stores it encrypted.

What sourcetype is used?

maskflare, with source maskflare. The event body is JSON.

Other siem and alerting integrations

Microsoft SentinelSlackMicrosoft TeamsPagerDuty

All integrations

See it on your own data

Try Maskflare free.
Bring your hardest prompts.

28-day free trial or 10,000 requests, whichever comes first. Point one app at the gateway or enroll a few laptops,
and watch what gets masked. Or talk to us first.

Start free trial Talk to us