SailPoint with Cribl Stream

What the source collects

The SailPoint Source in Cribl Stream receives log data from SailPoint Virtual Appliances using the HTTP Event Collector (HEC) protocol. The page lists Type: Push, TLS Support: Yes, and Event Breaker Support: No. It listens on /services/collector, and SailPoint's Virtual Appliance exporter posts to that standard path.

Two HEC endpoints are supported: send structured HEC events to /services/collector/event, and send raw, unstructured data to /services/collector/raw.

The Source does not support HEC indexer acknowledgements. Requests to /services/collector/ack return HTTP 400 with the text ACK is disabled.

Cribl Stream also uses internal fields to help process data from this Source. The four fields and their descriptions, copied from the SailPoint Source page:

__headers: Contains request headers when Capture request headers is toggled on.
__hecToken: Contains the HEC token associated with the event.
__inputId: Identifies the Source in the format sailpoint_hec:<input-id>.
__srcIpPort: Contains the source IP address and port.

Setting up the source

To configure a SailPoint Source, select Products, then Cribl Stream, and pick a Worker Group under Worker Groups. From there, either use QuickConnect: navigate to Routing > QuickConnect, select Add Source, choosing Select Existing or Add New; or use the Routes: select Data > Sources, select Add Source, and then SailPoint.

In the New Source modal, configure General Settings. Input ID is a unique name; if you clone the Source, Cribl Stream adds -CLONE to the original Input ID. Description is optional. Address, the hostname or IP address for HTTP or HTTPS listening, defaults to 0.0.0.0. Port is the port to listen on. Under Optional Settings, Tags let you filter and group Sources, and these tags aren't added to processed events. Select Save, then Commit & Deploy.

TLS is toggled off by default. When enabled, you can select a certificate from the store or enter paths manually: Certificate, Certificate path and Private key path (both in PEM format, with $ENV_VARS referenceable), and Passphrase to decrypt the private key. Under Mutual Authentication (mTLS), Authenticate client (mutual auth) defaults to off; when on, set Trusted client CA path to the CA certificates to trust, keep Validate client certificates on (default), and give Common name a regex to match against the CN and SAN fields (default /.*/; clients are rejected unless at least one match is found). Minimum TLS version and Maximum TLS version reject clients using versions below or above the thresholds.

Persistent queue defaults to off and buffers and preserves incoming events when a downstream Destination has an outage or experiences backpressure. Mode offers Always On (default), which always writes events to the persistent queue before forwarding, and Smart, which engages only when the Source detects backpressure. On Cribl-managed Cloud Workers with an Enterprise plan, the tab exposes only the Enable persistent queue toggle; if enabled, PQ is automatically configured in Always On mode with a maximum queue size of 1 GB of disk space allocated per PQ-enabled Source, per Worker Process. That 1 GB limit is on uncompressed inbound data and is not configurable; use a hybrid Group for configurable queue size, compression, and mode. All other settings in this section apply to on-prem and hybrid deployments only.

On on-prem and hybrid Workers, the remaining queue controls carry these defaults: Buffer size limit (bytes) runs 64KB to 10MB, defaults to 1MB, and replaces the deprecated events-based setting as of version 4.18.0; Commit frequency defaults to 42; File size limit defaults to 10 MB and must be greater than or equal to the buffer limit; Queue size limit defaults to 5 GB and can be set as high as 1 TB unless a different Worker Process PQ size limit is configured; Queue file path defaults to $CRIBL_HOME/state/queues, with /<worker-id>/inputs/<input-id> appended; Compression defaults to None, with Gzip also available; and Queue-full behavior chooses between blocking (the default) and dropping new data when the queue exerts backpressure. In Cribl Stream 4.1 and newer, the default Mode is Always on, to best ensure events' delivery.

Under Processing Settings, Fields add values to each event using Eval-like functionality: each is a Field Name and a Value, a JavaScript expression; fields configured here can be overridden by fields added at the token or request level. From the Pre-Processing Pipeline drop-down, select one Pipeline or Pack to process data before sending it through Routes.

Under Auth Tokens, add one or more tokens that SailPoint uses to authenticate, because if you don't configure a token, the Source permits unauthorized access. The Authentication method is Secret, a text secret; this Source doesn't support manually entered tokens. Select a local secret or global secret, or create a new text secret. Enable token defaults to on. Allowed indexes takes the values to allow in the HEC event index field at the token level, supports multiple values and wildcards, and skips validation when left blank. The Description becomes the token's display name, and per-token Fields are Field Name and Value pairs added to events that reference the token, overridable at the request level.

Advanced Settings control connection behavior. Show originating IP (off by default) extracts the client IP address and port from PROXY protocol v1 or v2 and, when enabled, ignores the X-Forwarded-For header. Capture request headers (off by default) adds request headers to events in the __headers field. Active request limit defaults to 256 per Worker Process, accepts 0 for unlimited, and is available only for on-prem deployments. Activity log sample rate defaults to 100, which logs every 100th request, with a minimum of 1. Requests-per-socket limit, Socket timeout (seconds), and Request timeout (seconds) all default to 0 (unlimited requests, indefinite wait); Keep-alive timeout (seconds) defaults to 5, minimum 1 second, maximum 600 seconds. IP allowlist regex defaults to /.*/ and IP denylist regex defaults to /^$/, with the denylist taking precedence over the allowlist. Environment (GitOps) names the Git branch that enables the configuration; blank enables it everywhere.

For Connected Destinations, select Send to Routes for conditional routing, filtering, and cloning via the Routing table, or QuickConnect for independent, direct connections to one or more Destinations.

After configuring the Source, export Virtual Appliance logs to Splunk HEC on the SailPoint side. The five forwarding settings, copied from the SailPoint Source page:

Set the HEC host to the hostname or IP address of this Source.
Set the HEC port to the Port you configured.
Set the HEC token to a token you created in the Auth Tokens settings.
If you enabled TLS on this Source, send data over HTTPS.
Don't enable Splunk indexer acknowledgements.

What the docs flag

The page's clearest security note sits under Auth Tokens: if you don't configure a token, the Source permits unauthorized access.

Troubleshooting repeats the acknowledgement behavior: send events to /services/collector/event or /services/collector/raw without requesting acknowledgements, and don't enable Splunk indexer acknowledgements on the exporter.

With Capture request headers enabled, the Source writes inbound headers to __headers, and some Destinations read that same field: HTTP Destinations such as Webhook, Loki, Microsoft Sentinel, Dynatrace HTTP, and Cortex XSIAM use it to inject dynamic request headers, and Kafka Destinations use it for message headers. Events can leave Cribl Stream with healthy Source, Route, and Destination metrics while data does not arrive or is rejected downstream; Destination logs may show no errors, or TLS certificate or hostname validation failures, or authentication errors such as invalid audience. The documented fix is an Eval Function in a Pipeline that removes __headers before the Destination, or copies it to another field name first; the Rename Function cannot operate on fields whose names begin with __. If TLS or certificate errors appear and __headers contains a host value, you can also toggle Validate server certs off on the Destination, though that weakens TLS verification and applies only after you confirm the conflict is the cause.

Persistent queue carries a deprecation notice: Smart mode is deprecated for Source persistent queue on hybrid and on-prem deployments, and in January 2027 affected configurations will automatically migrate to Always On mode. Before changing configuration, the page advises monitoring persistent queue usage, draining the queues first to avoid orphaned data, and verifying routing and filtering in a test environment before production rollout.

Frequently asked questions

How does SailPoint send log data to the SailPoint Source in Cribl Stream?

SailPoint Virtual Appliances export logs to Splunk HEC, and the Virtual Appliance exporter posts them to the /services/collector path on the Source. Structured HEC events go to /services/collector/event, and raw, unstructured data goes to /services/collector/raw.

Which authentication methods does the SailPoint Source in Cribl Stream support?

Only the Secret method, backed by a local or global text secret; this Source does not support manually entered tokens. Allowed indexes also restrict the values allowed in the HEC event index field at the token level; blank skips validation.

Does the SailPoint Source in Cribl Stream support HEC indexer acknowledgements?

No, the Source does not support HEC indexer acknowledgements. Requests to /services/collector/ack return HTTP 400 with the text ACK is disabled, so send events to /services/collector/event or /services/collector/raw without requesting acknowledgements.

What happens if you don't configure an auth token on the SailPoint Source?

If you don't configure a token, the Source permits unauthorized access. Add at least one Secret token under Auth Tokens and set the HEC token in the exporter to one you created.