Beacon is now Guard Detect, which is part of Atlassian Guard. Read the blog
The Guard Detect Add-on for Splunk is a powerful integration that enables you to index alerts in Splunk. With the add-on, we meet you where you work; alerting you to potential threats in your Atlassian cloud environment.
Step 1: Install the app
The way you install the app will depend on your Splunk deployment:
Remember to restart your Splunk instance after installing the app to make sure it functions correctly.
Step 2: Add your API token
You will need to create an API token in your Atlassian Account to connect the Splunk app. How to create an API token in Atlassian Account.
To create and add your API token:
Click Create API token.
Enter a name for the token. Make a note of the name, you’ll need this later.
Copy the API token, you’ll need this later.
In Splunk, select Apps > Guard Detect Add-on for Splunk.
Select Add.
Enter a name for the API token configuration.
Enter your email address (for the Atlassian Account used to create the token).
Enter the API token you created earlier.
Select Add to save the configuration.
Step 3: Add Guard Detect as a new input
Next you need to add Guard Detect as an input.
To add an input:
In Splunk, select Apps > Guard Detect Add-on for Splunk.
Select the Input tab.
Select Create new input.
Select the API token you created in the previous step.
Enter the Guard Detect workspace URL in the format https://detect-domain/w/your-workspace/alerts
Enter a Name for the input.
Set the Interval for the scripted input to run, in seconds.
Select which Index to send alert data to.
Specify a custom source tag for the alert data. This is optional.
Step 4: Check the input
To check the integration is working correctly:
In Splunk, select Apps > Guard Detect Add-on for Splunk.
Select the Input Health tab.
Check for any errors. If the integration is working you should see an input ran successfully message.
The app will now continuously monitor for and index new Guard Detect alerts in near real-time. How often this happens will depend on the interval you specified in the input configuration.
Step 5: Send a test alert
To send a test alert:
In Guard Detect, go to Integrations > SIEM forwarding.
Select Send test alert.
If the integration is working you should be able to search for the test alert.