HEC - LastPass

TEAM: Huntress Managed Security Information and Event Management (SIEM)
PRODUCT: HTTP Event Collector (HEC) Syslog
ENVIRONMENT: LastPass
SUMMARY: Configuration Guide for LastPass

• Vendor Information
• Configuration Checklist

This page only covers the device-specific configuration, you'll still need to read Huntress Managed SIEM Syslog Guide to complete the Huntress Managed SIEM setup as well as opening a port in Microsoft Defender Firewall.

Vendor Information

You must be an Account Administrator in Huntress in order to follow the steps below.

If the options don't appear available to you, please confirm you have the appropriate LastPass licensing.

1. Create Token

   1. Open Huntress Portal

   2. Click SIEM on the left navigation menu
   3. Click Source Management
   4. Click Add Source
   5. Click LastPass
   6. Click Add
   7. Provide a name for the Integration and an optional description.
   8. Click Save
   9. Copy the HTTP Event Collector Token value
2. Configure Integration in LastPass
   1. 1. 1. Log into LastPass Admin Console
         2. Click More
         3. Click Advanced
         4. Click Integrations
         5. Click SIEM Integrations
         6. Click Splunk
         7. In the Splunk Instance URL field, enter https://hec.huntress.io
         8. In the Token, paste the value from step 9 in the previous step.
         9. No Instance name is required
         10. Select Enabled
         11. Click "Save Changes"