trackme-broker

TrackMe Broker lets TrackMe on Splunk Cloud reach the systems on your own network: remote Splunk instances (Heavy Forwarders, Deployment Servers), self-managed Cribl Leaders and webhook receivers. From a Splunk Cloud stack those destinations cannot be reached, because the stack cannot connect into your network. TrackMe Broker reverses the direction. This add-on runs on a Heavy Forwarder on your side, asks the stack for work over its REST API on port 8089, makes the HTTPS call locally and posts the answer back. Every connection starts on your side: you open nothing inbound. - Deny by default: the forwarder reaches only the targets you declare on it, whatever the stack asks for. - Encrypted end to end: each request and response is sealed for one paired forwarder (AES-256-GCM, keys on P-256), on top of HTTPS. - Paired, not trusted blindly: you accept each forwarder in TrackMe after checking its key fingerprint. - Highly available: run two forwarders in one broker; they share the work, and one carries on if the other stops. - Least privilege, FIPS-approved cryptography: the add-on authenticates with an account holding only the trackme_broker role. Requires TrackMe 2.4.24 or later on the stack. Documentation: https://docs.trackme-solutions.com/product_guide/integ_broker.html