Splunk × Sentiqra
Send structured Sentiqra results to Splunk through your ingestion pipeline for dashboards, alerts, and SOC workflows.
Why This Integration Matters
Operational question this answers:
"How do Sentiqra detections flow into our SOC's ticket queue?"
No SOC lead deploys a detection API without a documented path into their SIEM. Splunk is the most widely deployed SIEM in enterprise environments, and the question "how do Sentiqra detections flow into Splunk?" is the top procurement question for cybersecurity buyers.
By publishing a reference architecture with log format specifications, correlation rule examples, and dashboard templates, you transform Sentiqra from an API that a SOC team has to figure out how to ingest into a pre-integrated detection source that drops into their existing Splunk deployment.
A Splunkbase listing - Splunk's official integration marketplace - is on the roadmap; enterprise buyers will find the packaged add-on through their own procurement tools.
Reference Architecture
┌──────────────────────────────────────────────────────────────┐
│ Your Infrastructure │
│ │
│ ┌──────────┐ ┌──────────────┐ ┌──────────┐ │
│ │ Sentiqra │───▶│ Transformer │───▶│ Splunk │ │
│ │ Detection │ │ Function │ │ HTTP │ │
│ │ (webhook │ │ (parse + │ │ Event │ │
│ │ or poll) │ │ format) │ │ Collector│ │
│ │ │ │ │ │ │ │
│ │ Returns: │ │ Maps to: │ │ Index: │ │
│ │ - groups │ │ - sentiqra. │ │ sentiqra │ │
│ │ - concepts│ │ group │ │ │ │
│ │ - confid. │ │ - sentiqra. │ │ SPL │ │
│ │ - latency │ │ concept │ │ searches │ │
│ │ │ │ - sentiqra. │ │ + alerts │ │
│ │ │ │ confidence │ │ │ │
│ └──────────┘ └──────────────┘ └──────────┘ │
│ │ │
│ ┌──────▼──────┐ │
│ │ Splunk │ │
│ │ Dashboards │ │
│ │ + Correlation│ │
│ │ Rules │ │
│ └─────────────┘ │
└──────────────────────────────────────────────────────────────┘Data flow: Sentiqra detection results are sent to a transformer function (Lambda, Azure Function, or Splunk DSP) → the transformer maps Sentiqra's JSON response to Splunk's event format → events are ingested via Splunk HTTP Event Collector (HEC) → Splunk indexes the events → correlation rules trigger alerts → SOC analysts see Sentiqra detections in their existing dashboards and ticket queues.
Working Code
Actual, tested, copy-pasteable code. Not pseudocode. Not aspirational.
Splunk HEC Event Format for Sentiqra
{
"time": 1700000000.000,
"host": "sentiqra.tech",
"source": "sentiqra:detect",
"sourcetype": "sentiqra:detection",
"index": "sentiqra",
"event": {
"request_id": "req_abc123",
"analyzer": "cybersecurity",
"text_hash": "a1b2c3d4e5f67890",
"language": "en",
"harmful": true,
"top_signal": "credential_lure",
"top_score": 0.97,
"configuration": "sqcfg_ZZW77NM9",
"fingerprint": "fp_b91c...4a",
"input_commitment": "ic_8f2e...71",
"latency_ms": 142
},
"fields": {
"sentiqra_signal": ["credential_lure", "phishing"],
"sentiqra_score": ["0.97", "0.82"],
"sentiqra_analyzer": "cybersecurity"
}
}Python - Send Sentiqra Detection to Splunk HEC
import os, requests, time, hashlib
SPLUNK_HEC_URL = "https://splunk.your-company.internal:8088/services/collector"
SPLUNK_HEC_TOKEN = "your-hec-token"
def analyze(text, analyzers):
response = requests.post(
"https://sentiqra.tech/v1/analyze",
headers={
"Authorization": f"Bearer {os.environ['SENTIQRA_API_KEY']}",
"Content-Type": "application/json",
},
json={"text": text, "language": "en", "analyzers": analyzers},
timeout=10,
)
return response.json()
def send_to_splunk(data, text, analyzer="cybersecurity"):
top = data["signals"][0] if data["signals"] else None
event = {
"time": time.time(),
"host": "sentiqra.tech",
"source": "sentiqra:analyze",
"sourcetype": "sentiqra:detection",
"index": "sentiqra",
"event": {
"text_hash": hashlib.sha256(text.encode()).hexdigest()[:16],
"analyzer": analyzer,
"top_signal": top["code"] if top else None,
"top_score": top["score"] if top else 0.0,
"configuration": data.get("verification", {}).get("configuration"),
"fingerprint": data.get("verification", {}).get("fingerprint"),
},
}
requests.post(
SPLUNK_HEC_URL,
headers={"Authorization": f"Splunk {SPLUNK_HEC_TOKEN}"},
json=event,
verify=True,
)
# Usage
text = "click here to verify your account"
send_to_splunk(analyze(text, ["cybersecurity"]), text)Splunk SPL - Correlation Rule Example
# Alert when Sentiqra detects phishing with score > 0.8
index=sentiqra sourcetype=sentiqra:detection
| where top_signal="phishing" AND top_score > 0.8
| stats count by source_ip, text_hash, top_signal, top_score
| where count >= 3
| eval severity=if(top_score > 0.9, "critical", "high")
| sendalert email to="soc@your-company.com" subject="Sentiqra: Phishing Detection Alert"Security & Compliance Posture
-
✓
NIS2 Article 21 - Incident Reporting: Sentiqra detections in Splunk can provide timestamped evidence relevant to cybersecurity incident reporting, with correlation rules that trigger automated alerts.
-
✓
SOC 2 Type II - CC7.2 - Monitoring: Splunk dashboards can support continuous monitoring of Sentiqra detection rates, confidence distributions, and latency.
-
✓
SOC 2 Type II - CC7.3 - Anomaly Detection: Correlation rules can detect anomalous patterns (e.g. sudden spike in phishing detections) and trigger incident response workflows.
-
✓
Audit Trail: Every Sentiqra detection is indexed with full attribution - request ID, timestamp, indicator, confidence, and configuration ID - retained per your Splunk retention policy.
-
✓
Splunkbase Listing (planned): A packaged Splunk add-on is in preparation for Splunkbase; until then, the documented HEC format is the integration path.
Deployment Notes
HEC Configuration
Configure a Splunk HTTP Event Collector (HEC) endpoint with a dedicated token for Sentiqra events. Create a sentiqra index and set the sourcetype to sentiqra:detection for automatic field extraction.
Data Volume
Each Sentiqra detection event is approximately 500 bytes. At 1M detections/day, this adds ~500MB/day to your Splunk ingestion - well within typical Splunk capacity.
Latency
HEC ingestion is asynchronous. Events appear in Splunk within 1–5 seconds of posting. The transformer function adds <50ms overhead.
Error Handling
If Splunk HEC is unreachable, buffer events in a local queue (e.g. Redis or SQS) and retry. Do not block Sentiqra detection calls on Splunk ingestion - decouple detection from SIEM forwarding.
Splunkbase Add-On (planned)
We are packaging the event format, field extractions, and dashboards as a Splunk add-on for Splunkbase. Until it ships, the HEC event format above is the supported path - ask us for early access to the add-on package.
Questions about this integration?
Talk to Solutions Engineering - first response within 1 business day.
Talk to Solutions Engineering →Related Integrations
Microsoft Sentinel
SIEM & SOAR
Ingest Sentiqra classifications into Microsoft Sentinel and apply your own analytics and correlation rules downstream.
Elastic Security
SIEM & SOAR
Index structured Sentiqra results in Elastic for search, dashboards, alerting, and analyst workflows.
Cortex XSOAR
SIEM & SOAR
Use Sentiqra classifications as inputs to your XSOAR playbooks and response logic. You define the enforcement policy. Sentiqra supplies the classification evidence.