Install Pando

HTTPS

https Posts every audit event, in batches as it is written, to a SIEM's HTTPS ingest endpoint: Splunk, Datadog, Elastic, Sumo Logic, Microsoft Sentinel, or anything that takes JSON with a token. A copy of the audit log leaves this installation.

Setup

In Splunk, Settings > Data inputs > HTTP Event Collector: under Global Settings set All Tokens to Enabled, then choose New Token and copy its value. The URL is your Splunk host on the HEC port, usually 8088, ending /services/collector/event. On Splunk Cloud the host is http-inputs-<stack>.splunkcloud.com on port 443.

  1. Create an HEC token

    1. In Splunk, open Settings → Data inputs → HTTP Event Collector.
    2. Under Global Settings, set All Tokens to Enabled.
    3. Choose New Token, finish it, and copy its value.

    Splunk HEC

    Settings token

  2. Enter the HEC endpoint

    1. Use your Splunk host on the HEC port, usually 8088, ending /services/collector/event.
    2. On Splunk Cloud, use https://http-inputs-<stack>.splunkcloud.com/services/collector/event.

    Settings url

  3. Adjust the connection

    Settings ca_certificate, extra_headers

  4. Choose which events to send

    Settings actions, exclude

Settings (17)
urlURL

The destination's ingest endpoint. Empty when Secret URL is set.

string · For example https://siem.example.com/ingest

secret_urlSecret URLCredential

The whole URL, for a destination whose URL carries its token, such as a Sumo Logic HTTP source.

string

tokenTokenCredential

The API key or token the destination checks.

string

bodyBody

The shape of each POST's body.

  • ndjson NDJSON — One event per line.
  • json_array JSON array — The batch as one array.
  • splunk_hec Splunk HEC — Each event in a HEC envelope with a sourcetype.
  • elastic_bulk Elastic bulk — A create action before each event, for a data stream's _bulk endpoint.
  • datadog Datadog logs — Each event as a Datadog log, with a message, source and date.

one of the values above · Default ndjson

auth_headerAuth header

The header the token is sent in.

string · Default Authorization

auth_schemeAuth scheme

The word before the token in the header.

  • Bearer
  • Splunk
  • ApiKey
  • none None — The token is the whole header value.
  • or another value

one of the values above · Default Bearer

ca_certificateCA certificate

PEM certificates to trust for a destination on a private certificate authority. Empty trusts the system's.

string

extra_headersExtra headers

Headers to add, one per line as Name: value. Not encrypted, so not for anything secret.

string · For example X-Source: pando

sourcetypeSplunk sourcetypeAdvanced

The sourcetype each HEC envelope names.

string · Default pando:audit · Used when body is splunk_hec

allow_httpAllow httpAdvanced

Post over plain http, unencrypted. Only for a destination on a trusted network.

bool

max_body_bytesMax body sizeAdvanced

The most bytes one POST carries; a larger batch goes as several. 0 is no limit, or 5000000 for the Datadog body.

int · Default 0

timeout_secondsTimeoutAdvanced

Seconds to wait for the destination to answer a batch.

int · Default 15

actionsActions

Comma-separated action prefixes to send. Empty sends every event.

string · For example deploy, install.

excludeExclude

Comma-separated action prefixes not to send. app.use, a record of each request to an app, is usually most of the volume; exclude it if your SIEM bills by ingest.

string · For example app.use

formatEvent formatAdvanced

How each event is encoded.

  • native Native — The event as Pando stores it.
  • ocsf OCSF — OCSF 1.3.0, for a SIEM that maps it.

one of the values above · Default native

max_batchBatch sizeAdvanced

The most events sent in one delivery.

int · Default 500

startStartAdvanced

Where a new destination's first delivery begins. Read once, when Pando first sends to it.

  • oldest The oldest event in the live log
  • now Only events from now on

one of the values above · Default oldest