icon/x Created with Sketch.

Splunk Cookie Policy

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website. Learn more (including how to update your settings) here.
Accept Cookie Policy

We are working on something new...

A Fresh New Splunkbase
We are designing a New Splunkbase to improve search and discoverability of apps. Check out our new and improved features like Categories and Collections. New Splunkbase is currently in preview mode, as it is under active development. We welcome you to navigate New Splunkbase and give us feedback.
Splunkbase will be undergoing a scheduled migration and will be unavailable on Saturday, Oct 1, 2022, from 11AM to 3PM PDT

Accept License Agreements

This app is provided by a third party and your right to use the app is in accordance with the license provided by that third-party licensor. Splunk is not responsible for any third-party apps and does not provide any warranty or support. If you have any questions, complaints or claims with respect to this app, please contact the licensor directly.

Thank You

Downloading Beyond Identity Splunk Add-on
SHA256 checksum (beyond-identity-splunk-add-on_101.tgz) 36c32146326cd1b853ff616f31f0cac98c30fb4ea4b45060f0d0fa67e72a3061 SHA256 checksum (beyond-identity-splunk-add-on_100.tgz) 5091c7e26d79daeda07edee0120fe025ea2bd0876808dfab42a5dc09db1b585b
To install your download
For instructions specific to your download, click the Details tab after closing this window.

Flag As Inappropriate


Beyond Identity Splunk Add-on

Beyond Identity + Splunk:

Beyond Identity’s integration with Splunk feeds real-time data about the users and devices attempting to access your critical cloud resources across applications. When Splunk is integrated with Beyond Identity, security teams can ensure only secured devices and authorized users access company data. This stops all password-based attacks and definitively blocks lateral movement, feeding real-time risk signals into Splunk Enterprise Security to help improve threat detection and incident response.

Beyond Identity continuously gathers data concerning the security posture of registered devices and forces their adherence to organizational device security policies. Real-time risk-based authentication is informed by dozens of user and device risk signals during each login - enabling customers to enforce continuous, dynamic access control across the cloud applications and resources used to operate your organization.

When Splunk is integrated with Beyond Identity, security teams get:

Strong Authentication Beyond Identity eliminates passwords as an authentication method and cryptographically binds user identity to the device via the secure TPM hardware on the device. This eliminates credential-based attacks and provides a very high assurance of the user identity before allowing access to critical SaaS resources.

Granular Risk Signals and Immutable Logs Beyond Identity captures granular device security posture data at the exact time of login such as operating system version, security software state, and device type. Authentication event data is captured and aggregated in the Beyond Identity Administrative Portal for every login attempt.

Identify Risky Users Beyond Identity stops unauthorized users and rejects devices from authentication if they do not meet an organization’s security requirements. Unauthorized devices that are not bound to a valid identity are stopped from authenticating. All authentication data is fed into Splunk and normalized to inform threat detection defense

Event Mapping to CIM Beyond Identity injects data from every authentication attempt into Splunk’s Common Information Model to extract insights about the security posture of device-bound users, their authentication attempts, and the rejection of those who failed to satisfy device security requirements.

Supported Versions:

Splunk Enterprise: Version 8.2, 8.1
Python: Version 3.6

Get the Add-on:

**Please contact Beyond Identity support at support@beyondidentity.com to collect configuration details including API URL and API key (token)**


Beyond Identity is integrated with Splunk SIEM. This integration allows Beyond Identity Splunk Add-on to pull event log data from Beyond Identity’s cloud using a data export API. This User Guide provides documentation to install and set-up this integration. It covers all the details needed to successfully setup the Add-on on a local Splunk Enterprise 8.x instance. It also provides a quick overview of the Add-on.


2.1 You will need to have access to an instance of Splunk Enterprise 8.x or above. Please follow the instructions, as provided by Splunk, for the installation of Splunk Enterprise 8.x or above.
2.2 You will need the Beyond Identity Splunk Add-on. It can be downloaded from the following link: https://splunkbase.splunk.com/app/5622/
Installation instructions are given further down in this document.
2.3 To be able to view the CIM visualizations, the CIM package needs to be downloaded from the following link: https://splunkbase.splunk.com/app/1621/
Installation instructions are given further down in this document.


3.1 Login with your administrator credentials into the Splunk Enterprise.
3.2 You will land on the “Dashboard” screen.
3.3 On the “Dashboard” screen, on the top left corner, click on the gear icon next to “Apps” and you will be navigated to the “Manage Apps” screen. On this screen, you will notice a few Splunk apps that are already installed by default.
3.4 Click on the “Install app from file” button, click on “Choose File”, select the “.tgz” file (downloaded in Step 2.2) and upload it by clicking on the “Upload” button. (If you are uploading for the first time, do not click the “Upgrade App” checkbox.)
3.5 After Uploading the “.tgz” file, click on “Restart Now”.
3.6 Now login again, click on “Apps” dropdown and check whether the “Beyond Identity” App is available.
       3.6.1 Click on “Settings” in the top navigation bar (towards the right).
       3.6.2 Click on “Indexes” > “New Index”
       3.6.3 Enter the index name and select the app name from the app section and save the index.
       3.6.4 Click on “Apps” >”Beyond Identity”, click on the “Create New Input” button and fill in all the required fields and select index from index dropdown (if user created the index, otherwise it will be the default index.)

Field Name Description
Name Any unique name can be entered here. Space character is not allowed.
Interval The interval after which the data will be pulled in to Splunk. (For example, if 100 is given, after every 100 seconds, data will be pulled in to Splunk.)
Index Splunk has an index feature. The log types which will be retrieved in Splunk are saved against an index. The index is set to default or the created index.
API URL https://dataexport-public.byndid.com/v1/events
API Key Enter the API Key provided by Beyond Identity to authorize the user for retrieving data via the API.
Start Date Enter the Start date from which to pull the data. The default is 7 days back.

       3.6.5 After the new input is created, the Inputs screen will populate.
       3.6.6 On the search bar, write query index="index_name" (if index is created, otherwise go to 3.6.7 steps.)
       3.6.7 Click on “Search” > “How to Search” > “Data Summary” > “SourceTypes”.


4.1 Install the CIM mapping Add-on “.tgz” file (downloaded in Step 2.3) similar to Beyond Identity Splunk Add-on installation (Step 3.4).
4.2 Click on “Settings” > “Data Models”
4.3 Click on “Authentication”
4.4 Click on “Pivot”
4.5 Click on “Authentication”.
4.6 Click on the “Pie Chart” on the left navigation bar and click on “Add Color”, select “src”.
Follow similar steps for other CIM mapping models and corresponding fields.


To uninstall the Add-on from Splunk Enterprise, run the following command from bin directory:
./splunk remove app <appname>

Release Notes

Version 1.0.1
July 29, 2021

This Beyond Identity add-on enables customers to view their authentication events such as: successful logins, failed login attempts. Customers are able to get in depth information about IPS and location of login attempts.

Version 1.0.0
June 25, 2021

Beyond Identity Splunk Add-on :
Beyond Identity add-on enables customers to view their authentication events such as: successful logins, failed login attempts. Customers are able to get in depth information about the IPs and location of login attempts.

Supported Versions

Splunk Enterprise: Version 8.1
Python: Version 3.6

Release Notes
Version 1.0.0


  • Beyond Identity Splunk Add-on provides  ingestion of  the BI’s events data and  will parse the data, map to CIM and write to Splunk using the Splunk SDK.
  • The Add-on will have the functionality to specify the proxy server (HTTP/HTTPs proxy only) details and  the set the logging level .

Subscribe Share

Are you a developer?

As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.

Follow Us:
Splunk, Splunk>,Turn Data Into Doing, Data-to-Everything, and D2E are trademarks or registered trademarks of Splunk Inc. in the United States and other countries. All other brand names,product names,or trademarks belong to their respective owners.