Safeguard Docs
Compliance ConnectorsSetup by categoryObservability

Splunk SOAR

Connect Splunk SOAR to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.

Connect Splunk SOAR to collect observability evidence with automated compliance tests, switched on per workspace.

CategoryObservability
Connect withAPI token
What a connection producesAutomated compliance tests
Splunk SOAR's guidehelp.splunk.com

Connect with an API token

  1. In Splunk SOAR:

    1. Log in to Splunk SOAR as an administrative user. From the Main Menu, select Administration.
    2. Select User Management › Users.
    3. Click + User and select Automation as the user type.
    4. Provide a user name and fill in Allowed IPs: use any for unrestricted access, or a single IP or netmask (Safeguard's outbound address).
    5. Choose one or more roles for the user; the default Automation role is available for this user type.
    6. Click Create, then click the user name you just created. Copy the ph-auth-token value from the Authentication Configuration for REST API panel.

    Where to find the other values:

    • Base URL: The server value in the same Authentication Configuration for REST API panel is the URL used for REST requests.

    RE-GENERATE AUTH TOKEN issues a new token and invalidates the old one. The token is only valid from the IPs in Allowed IPs. A narrower custom role for read-only container access is not described on the fetched page.

    Source: help.splunk.com, checked 2026-10-07.

    The permissions Safeguard needs: automation user, read on containers.

  2. On Compliance › Connectors, open Splunk SOAR, click Connect, choose API token and fill in:

    FieldWhat to enter
    Base URLRequired. Your own server: an https address reachable from the internet.
    Auth tokenRequired. Stored encrypted and never shown again.

  3. Click Connect with token.

Frameworks

Safeguard's automated tests read Splunk SOAR and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.

FrameworkEvidenceControlsTests
SOC2Automated testsCC7.3, CC7.42
ISO/IEC 27001Automated testsA.5.262
HIPAA Security RuleAutomated tests164.308(a)(6)2
PCI DSSAutomated tests12.10.12
NIST CSF 2.0Automated testsRS.MA-03, RS.MI-022

These tests are switched on per workspace by the Safeguard team.

Splunk

Connect Splunk to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.

Sumo Logic

Connect Sumo Logic to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.

On this page

Connect with an API tokenFrameworksRelated