Add Rubrik Security Cloud IP addresses to the allow list in Splunk Cloud

Applicability

Description

To integrate Rubrik Security Cloud (RSC) with Splunk Cloud, a HEC token needs to be created in Splunk Cloud and the Rubrik Cloud address needs to the allowed to connect to the HEC endpoint and port 443 in Splunk Cloud. However, the IP address is not available, just the domain name.

Investigation

It is not possible to add a domain name to the allowlist in Splunk Cloud, under Settings > Server settings > IP allow list.

This is possible for Webhook, the URLs in which Splunk Cloud is permitted to send HTTP POST requests, can be allowed.

More details under Configure webhook allow list using Splunk Web.

Note: Keep in mind that the HEC token being used for Rubrik Cloud should not have ACK enabled. Per documentation: "Splunk Cloud Platform does not support indexer acknowledgement in HEC, it only supports it for AWS Kinesis Firehose."

Resolution

The Rubrik Security Cloud documentation provides steps on how to locate the IP address for the RSC domain: Finding the RSC IP address

Locate the IP address of your RSC domain for various use cases.

Procedure:

1. Log in to RSC.
2. From the silhouette menu, select About Rubrik Security Cloud.
3. The About Rubrik Security Cloud window appears.
4. Hover over the region link.
5. The list of IP addresses for your RSC domain appears.
6. Scroll down to get all the addresses available.

Once all the IP addresses are collected, add them to the Splunk Cloud allow list.

With Splunk Cloud release 8.2.2201 or higher, you may configure the API allow list by using Splunk Web in a self-service manner:
Configure IP allow lists using Splunk Web

Alternatively, you may configure IP allow lists programmatically using the Admin Config Service (ACS) API:
ACS Usage
Configure IP allow list with ACS

Related Links

RSC - Splunk requirements