TEAM: Huntress Managed Security Information and Event Management (SIEM)
PRODUCT: SIEM
ENVIRONMENT: HTTP Event Collector
SUMMARY: Configuration Guide for Generic HTTP Event Collector

• Overview
• Source Requirements
• Configuring the HTTP Event Collector
• • Authentication Token Creation
  • Configuring the Source

Overview

The Generic HTTP Event Collector (HEC) allows for the sending of application event and log data to Huntress over the HTTP and Secure HTTP (HTTPS) protocols. Upon successfully configuring a source and the Generic HTTP Event Collector, the source will send data to the Collector URL. Sources configured this way will not have ECS normalized fields or categories but will have base level JSON parsing.

Source Requirements

1. The source must support token-based authentication.
2. The source must send data in a JSON-formatted array with “event” as the top object.

Configuring the HTTP Event Collector

Authentication Token Creation

1. Open the Huntress Portal
2. Click on SIEM on the left navigation menu
3. Click Source Management
4. 
5. Click Add Source
6. Choose Generic HEC
7. 
8. Click Add
9. 
10. Set Configuration Details
    1. Select the appropriate Organization from the dropdown
    2. Enter a unique name of the source
    3. (Optional) Enter a description for the source
    4. 
11. Click Save
12. Record the HTTP Event Collector Token
    1. Note: Keep this secure as it is the equivalent of a password
    2. 

Configuring the Source

Each log source will have it’s own unique configuration steps. However, as noted in the requirements section above it does need to support token-based authentication. If the source supports integration with Splunk’s HEC, the same mechanism and source configuration steps are supported by the Huntress HEC.

Huntress HEC URL: https://hec.huntress.io/services/collector