Splunk

Forge delivers normalized security_event.v1 records to the Splunk HTTP Event Collector. Export scope, content detail, replay, acknowledgement, and delivery health are configured per destination. See Security Exports for shared filtering, health, multiple-destination, and replay behavior.

Events

Category	Records
`agent_event`	Agent session and event activity
`governance_signal`	Policy and governance evaluation evidence
`finding`	Security findings
`org_audit`	Organization audit records
`managed_config_audit`	Managed configuration changes and drift
`agent_attribution`	Provider-to-agent attribution results
`compliance_assessment`	Compliance evaluation records
`governance_workflow`	Requests, approvals, and workflow state

HEC config

Field	Description
Endpoint URL	Splunk HEC `/services/collector/event` endpoint
Token	HEC token stored as a Forge-managed secret
Index	Destination index allowed by the token
Source and sourcetype	Stable Splunk routing and field-extraction values
Host	Optional HEC host field
Indexer acknowledgement	Wait for Splunk acknowledgement before advancing delivery
TLS verification	Certificate verification is enabled by default

Filters

Filter	Values
Category	Any supported event categories
Minimum severity	`info`, `low`, `medium`, `high`, or `critical`
Source	Source adapter keys
Product	Product identity keys or product entity IDs
Identity	Directory user IDs
Endpoint	Device IDs

Detail

Level	Payload
`metadata_only`	Stable IDs, routing, timestamps, category, and severity
`indexed_summary`	Metadata plus indexed title, summary, and searchable context
`full_body_reference`	Reference to retained detail without inlining the body
`full_body_inline`	Available body fields permitted by export and privacy policy

Prompt, tool-input, tool-output, and raw-body inclusion can be controlled independently. The export never manufactures unavailable detail.

Connection

Create an HEC token allowed to write the target index, then enter its event endpoint, token, index, source, sourcetype, and host in Forge.
Select categories, minimum severity, source/product/identity filters, and the detail policy.
Send the synthetic test event, verify its indexed fields and acknowledgement state in Splunk, then activate the destination.

index=forge_security sourcetype=forge:security_event earliest=-15m
| stats count by category severity

Delivery

Forge maintains a cursor per event category and records delivered events, bytes, skipped events, batch attempts, Splunk acknowledgement IDs, and dead letters. Replays target an explicit time window and category set without rewinding the continuous-delivery cursors.

Get started

Observe

Secure

Enable

Integrations

Resources

Events

HEC config

Filters

Detail

Connection

Delivery

​Events

​HEC config

​Filters

​Detail

​Connection

​Delivery

Events

HEC config

Filters

Detail

Connection

Delivery