> For the complete documentation index, see [llms.txt](https://docs.expel.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.expel.io/connect-your-technology/q-z-integrations/splunk/splunk-collector-setup-for-workbench.md).

# Splunk Collector Setup for Workbench

## Prerequisites <a href="#h_01j2f0kgtpbww7mra25cgys3f1" id="h_01j2f0kgtpbww7mra25cgys3f1"></a>

1. To ensure Expel will be able to connect, contact Splunk and ask them to allow traffic from [the IP addresses listed in this topic](/workbench-setup/configure-an-ip-allow-list.md).

## Step 1: Add Splunk as a Security Device in Workbench <a href="#h_01j2f0nxxmpkhyedaryb5c15fs" id="h_01j2f0nxxmpkhyedaryb5c15fs"></a>

Make sure you have met the [prerequisites](#h_01j2f0kgtpbww7mra25cgys3f1) before proceeding with this step.

1. [Log in to Workbench](https://workbench.expel.io/auth/login?orig=%2F).
2. In the side menu, navigate to **Organization Settings > Security Devices**.
3. Select **Add Security Device**.
4. In the search box, type “Splunk” and then select the **Splunk Collector** integration.
5. A configuration pane displays. Complete the fields as follows:
   * **Where is your device?** - select the location of your device.
   * **Name** - enter a name that might help you more easily identify this integration, such as “CompanyName Splunk Collector”; this name will display in Workbench under the Name column, and is a text string that you can filter on.
   * **Location** - enter the location of your integration, for example, “cloud.” This is also a text string that you can filter on, so we recommend being consistent with location naming across your Expel integrations.
   * **Connection Settings** - provide the appropriate information:
     * **Username** - enter the username used to authenticate with this device.
     * **Password** - enter the password used to authenticate with this device.
     * **Server address** - *Splunk Cloud:* enter the Splunk server address and port. *Splunk On-Premises:* enter the console IP address and port.
     * **API token** - enter the Splunk API token used to authenticate the device. If none is provided, username and password will be used.
6. Select **Save**.
7. Your device should be created successfully within a few seconds.

{% hint style="info" %}
Collector integrations do not support health checks, so an appearance of little or no activity is expected. The (via Collector) integrations are what‌ present data – the Collector itself just facilitates passing the query to the integration receiving the information.
{% endhint %}

## Step 2: Enable Console Access <a href="#h_01j2f0z3yzdje8z5hbmeqqerfa" id="h_01j2f0z3yzdje8z5hbmeqqerfa"></a>

To provide effective triage and analysis, we ask that customers enable Expel with console access. Having read-only access to the interface of your technology allows Expel to dig deeper during incident investigations. Our device health team uses this access to investigate potential health issues with your tech. For more information, see [Why Expel Asks for Console Access](/connect-your-technology/about-integrations/why-expel-asks-for-console-access.md).

1. [Log in to Splunk](https://login.splunk.com/).
2. Navigate to **Settings > Access Controls > Users**.
3. Select **Add new**.
4. Enter the following information:
   * **Name** - enter "Expel".
   * **Full name** - enter "Expel SOC".
   * **Email address** - enter "<soc@expel.io>".
   * **Password** - set the Password.
   * **Time Zone** - select GMT (or UTC).
   * **Assign roles** - select **User**.
   * **Require password change on first login** - set this to **unchecked**.
5. Select **Save**.
6. Now that you have enabled console access in Splunk, you may choose to enable console access in Workbench on your own, or you may [contact Expel Support](/support/how-to-reach-us.md) to do it for you. If you would like to do it yourself, continue with the following steps.
7. [Log in to Workbench](https://workbench.expel.io/auth/login?orig=%2F).
8. In the side menu, navigate to **Organization Settings > Security Devices**.
9. Locate the Splunk Collector you added in [Step 1](#h_01j2f0nxxmpkhyedaryb5c15fs). Select the dropdown arrow in the first column and select **Edit**.
10. Enter your credentials into the Console Login (Optional) section.
11. Select **Save**.

## Additional Criteria for Support <a href="#h_01j44p78j9w6rnw03rvsg1y9dh" id="h_01j44p78j9w6rnw03rvsg1y9dh"></a>

The actions below improve our ability to normalize custom alerts so they are properly presented in Workbench. They also equip our analysts with necessary context so they can make informed decisions.

**CIM Compliance**\
To properly display alert evidence in Workbench, fields must be normalized according to Splunk's Common Information Model. Expel only uses a portion of the 500 CIM fields available for alert normalization. Expel uses version 6 of CIM Compliance.

Proper normalization also enables Ruxie to perform automated actions on the alert. We rely on proper normalization to create detections, suppressions, bloom for detections (alert deduplication), BOLOs, and in-depth DUET messages. If a CIM field isn't being used and is requested to be a part of alert normalization or DUET messages, then we typically can't support the request.

Please review the fields being returned from Splunk searches to ensure they map to what is shown in [Splunk's Common Information Model Add-on Manual](https://help.splunk.com/en/splunk-cloud-platform/common-information-model/6.1/data-models/cim-fields-per-associated-data-model).

**Use the Description Field**\
Any additional information about the custom rule that may be useful for our analysts should be included in the Description. Examples include the detection’s intent and suggested steps to triage.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.expel.io/connect-your-technology/q-z-integrations/splunk/splunk-collector-setup-for-workbench.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.