Integration / Security & SIEM
Splunk, routed by jurisdiction.
Stream YTT Secunet policy decisions and proof-of-residency receipt events into Splunk Enterprise or Splunk Cloud Platform through the HTTP Event Collector, so residency evidence sits next to the rest of your security telemetry and can drive alerts.
Splunk
Security & SIEM
- Regions documented
- 4
- Setup steps
- 7
Splunk, part of Cisco since March 2024, is the SIEM and log analytics platform many security teams already run, either as Splunk Enterprise on their own infrastructure or as Splunk Cloud Platform. Its HTTP Event Collector (HEC) accepts events over HTTPS: a client posts JSON to the /services/collector/event endpoint with an Authorization: Splunk header carrying a token, and Splunk indexes the payload. Tokens can be restricted to specific indexes and given a default sourcetype, several events can travel in one request, and indexer acknowledgment can be switched on when delivery has to be confirmed.
YTT Secunet uses HEC as a log streaming destination and sends two event types. Policy decision events record the tenant, the policy pack id and version, the rule that allowed or denied the call, the resolved endpoint and provider region, detected data categories and masking counts, and the latency the gateway added. Receipt events carry the receipt hash, the X-YTT-Proof-Signature JWS, the Merkle leaf index and, once the hour closes, the published root. Neither type contains prompt or completion content: requests appear as SHA-256 hashes, so the SIEM never becomes a second store of the data you were careful to route.
Events are sent from the data plane that handled the request, so a decision made in the EU data plane travels from there to your collector. That makes the location of your Splunk deployment part of the design. Decision events include tenant and pseudonymous user identifiers, which can be personal data; if your Splunk Cloud Platform stack or Splunk Enterprise cluster sits in another jurisdiction, record the flow in your RoPA, or turn on identifier redaction for the stream so only keyed hashes leave the region. Splunk holds copies for search and alerting; the Merkle-anchored ledger remains the authoritative record, and ytt-verify checks it independently.
| Region or deployment | Location | Jurisdiction |
|---|---|---|
| EU data plane log stream | Frankfurt am Main, Germany | EU / European Union |
| UK data plane log stream | United Kingdom | UK / United Kingdom |
| US data plane log stream | United States | US / United States |
| Sovereign Dedicated data plane | Customer private cloud, Riyadh | GCC / Middle East (GCC) |
- 01
In Splunk, create an index for YTT Secunet events, for example yttsecunet_residency, with the retention period your evidence policy requires.
- 02
Create an HEC token restricted to that index with yttsecunet:decision as its default sourcetype. On Splunk Enterprise, check that HEC is enabled in the global settings and served over TLS.
- 03
Turn on indexer acknowledgment for the token if you need confirmed delivery; YTT Secunet sends a request channel and waits for the acknowledgment before releasing a batch from its buffer.
- 04
In the YTT Secunet console (Enterprise Sovereign or Sovereign Dedicated), add a log stream destination of type Splunk HEC with your collector URL, store the token in the YTT Secunet secret vault or your own KMS, and choose the event types and data planes to stream.
- 05
If your collector filters by source address, allow the egress addresses the console lists for each YTT Secunet data plane.
- 06
Send a test event from the console and confirm it in Splunk with a search such as index=yttsecunet_residency sourcetype=yttsecunet:decision | stats count by decision, policy_pack.
- 07
Build alerts for denial spikes, resolved regions outside a tenant's jurisdiction and gaps in the hourly Merkle roots.
POST /services/collector/event HTTP/1.1
Host: http-inputs-acme.splunkcloud.com
Authorization: Splunk <hec-token from vault://splunk/hec>
Content-Type: application/json
{"time": 1793959200.214, "host": "dp-eu-fra-03", "source": "yttsecunet", "sourcetype": "yttsecunet:decision", "index": "yttsecunet_residency", "event": {"tenant": "tenant-de-0142", "policy_pack": "eu-gdpr-strict", "policy_version": "2026.10.3", "decision": "allow", "rule": "eu_in_region", "endpoint": "azure-openai-gwc", "provider_region": "germanywestcentral", "request_sha256": "9f2c4b7e...e41a", "pii_masked": 3, "added_latency_ms": 5.1}}
{"time": 1793959200.219, "host": "dp-eu-fra-03", "source": "yttsecunet", "sourcetype": "yttsecunet:receipt", "index": "yttsecunet_residency", "event": {"receipt_sha256": "c07d18aa...91b2", "merkle_leaf": 48211, "hour": "2026-11-06T10:00:00Z", "jws": "eyJhbGciOiJFZERTQSJ9..."}}- Events never contain prompt or completion text. Requests and receipts are identified by SHA-256 hashes, and the stream refuses to start if a custom field mapping would add content.
- Identifier redaction replaces tenant user identifiers with keyed hashes before events leave the data plane, for SIEMs located outside the tenant's jurisdiction.
- If the collector is unreachable, events are buffered encrypted on the data plane and retried with backoff; a growing buffer raises a console alert instead of dropping evidence silently.
- Splunk copies are for search and alerting. For audits, verify receipts against the published hourly Merkle roots with ytt-verify, which depends on neither Splunk nor YTT Secunet.
Does this work with both Splunk Enterprise and Splunk Cloud Platform?
Yes. Both expose the HTTP Event Collector. You give YTT Secunet the collector URL and a token; the events are identical either way.
Is there a Splunkbase app to install?
No app is required. YTT Secunet sends standard HEC events with two documented sourcetypes, yttsecunet:decision and yttsecunet:receipt, so you search them with SPL and build dashboards and alerts as you would for any other source.
Could streaming logs to Splunk create a transfer?
It can, if your Splunk deployment sits in another jurisdiction, because decision events contain identifiers that may be personal data. The events carry no prompt content, and identifier redaction narrows the rest; record the flow in your RoPA either way.
Sovereign route ready
Stop risking 4% global turnover GDPR fines on AI inference.
Deploy sovereign, cryptographically proven AI routing in 15 minutes.