Veza

The Veza Add-on for Splunk ingests platform events and audit log entries from Veza tenants through cursor-paginated REST API endpoints. The add-on provides two modular inputs that authenticate via OAuth2 client credentials and deliver events with checkpoint management to ensure at-least-once delivery. Events are exported from the /api/v1/events/export and /api/v1/system/audit/export endpoints and indexed under the veza:events and veza:audit sourcetypes respectively. The add-on persists cursor state between collection runs, enabling administrators to monitor Veza authorization activity, access events, and system audit trails within Splunk. Each input is configured per Veza tenant, allowing organizations to consolidate event data from multiple Veza instances into a single Splunk deployment.