Skip to main content

Integrating Druva with Huntress SIEM via Webhooks

Integrating Druva with Huntress SIEM via Webhooks

This guide provides step-by-step instructions to connect Druva to the Huntress SIEM using an HTTP Event Collector (HEC) webhook.

Prerequisites

  • A Huntress Account with SIEM capabilities enabled.

  • Administrator access to the Druva Management Console.

  • A Huntress HEC Token (API Key) generated from the Huntress portal.

Step 1: Configure the Webhook in Druva

  1. Log in to the Druva Management Console.

  2. Navigate to Settings > Webhooks and click Add New.

  3. Fill in the following details:

    • Webhook Name: Huntress SIEM (or preferred name).

    • Endpoint URL: https://hec.huntress.io/services/collector/raw.
      ​Note: Using the /raw suffix is required for Huntress to correctly parse Druva's native JSON format.

    • Authorization Type: API Key.

    • API Key: Enter Splunk followed by your Huntress API key (e.g., Splunk 12345-abc-6789).
      ​Critical: The word Splunk and the space before the key are mandatory for Huntress HEC authentication.

  4. Select the Event Types you wish to monitor (e.g., Alerts, Admin Events, Backup and Restore).

  5. Click Test and Save.

Step 2: Enable Event Export in Druva Settings

Validation in Step 1 only confirms the connection; you must globally enable data export for events to flow.

  1. Go to inSync Settings (or product-specific settings) > inSync APIs.

  2. Locate Events API Settings and click Edit.

  3. Check the box for Export Events.

  4. Confirm the categories you wish to export are selected and click Save.

Step 3: Verify Data in Huntress

It can take 15 to 30 minutes for the first events to appear in the Huntress portal.

  1. In the Huntress Portal, click the Huntress Logo to ensure you are at the Account Scope level.

  2. Navigate to SIEM > Search.

  3. Run the following query to view incoming Druva logs: from logs | where event.provider == "GenericHEC"

Troubleshooting Tips

  • No Data Appearing: Ensure you are using the /raw endpoint. Standard /collector endpoints often fail to parse third-party JSON.

  • Invalid Credentials: Double-check that there is exactly one space between Splunk and your API key.

  • Missing Events: Verify that "Export Events" is toggled 'On' in the Druva API settings, as saving a webhook alone does not always trigger data transmission.

Related Articles
Did this answer your question?