Splunk

Forward every Cheqpoint approval event to Splunk via HTTP Event Collector (HEC). Build dashboards, alerts, and correlation rules over AI agent actions alongside your existing security data.

1. Set up Splunk HEC

bash

# In Splunk Web:
# Settings → Data Inputs → HTTP Event Collector → New Token

Name:        cheqpoint-approvals
Source type: _json
Index:       main  (or a dedicated security index)

# Copy the token - you'll paste it into Cheqpoint next.

2. Configure the Notification URL in Cheqpoint

text

Settings → Integrations → Splunk → Enter HEC endpoint → Save

HEC endpoint format:
  https://<splunk-host>:8088/services/collector/event

Cheqpoint sends:
  Authorization: Splunk <your-HEC-token>
  Content-Type: application/json

3. Splunk HEC event format (Cheqpoint wraps automatically)

json

{
  "time": 1760561520,
  "source": "cheqpoint",
  "sourcetype": "cheqpoint:approval",
  "event": {
    "requestId": "req_01j3abc",
    "action": "delete_records",
    "status": "approved",
    "agentName": "Data Cleanup Bot",
    "riskScore": 0.75,
    "decidedBy": "sarah@company.com",
    "decisionNote": "Confirmed with data owner - safe to proceed",
    "createdAt": "2026-10-15T09:12:00Z",
    "decidedAt": "2026-10-15T09:17:42Z"
  }
}

4. Splunk search: high-risk approvals

text

index=main sourcetype="cheqpoint:approval" status="approved" riskScore>0.7
| table _time, agentName, action, decidedBy, riskScore, decisionNote
| sort -riskScore

5. Splunk alert: agent volume anomaly

text

index=main sourcetype="cheqpoint:approval"
| timechart span=1d count by agentName
| anomalydetection action=annotate
| where isanomaly=1

6. CEF export for Splunk file-based ingestion

text

# For Splunk Universal Forwarder / file-based ingestion, use CEF export:
# Audit Log → Export CEF → download .cef file

# CEF format:
CEF:0|Cheqpoint|ApprovalGate|1.0|req_01j3abc|delete_records|9|rt=... suser=sarah@company.com act=APPROVED

# Add to inputs.conf:
[monitor:///var/log/cheqpoint/*.cef]
sourcetype = cef

Recommended Splunk dashboards

AI agent approval rate by agent name (approval health per assistant)
High-risk action volume over time (trend of riskScore > 0.7 requests)
Mean time to decision by reviewer (SLA performance)
Rejected actions by action type (what your agents are attempting most often)
Regulatory tag breakdown (EU AI Act / SOX / HIPAA coverage)