- kind: regex
pattern: '(?i)(?:splunk)[\s:="'']+\b([a-zA-Z0-9]{22})\b'
category: auth_token
label: splunk_observability_token
- kind: regex
pattern: '(?i)(?:splunk[_-]?(?:hec[_-]?)?token|hec[_-]?token)[\s:="'']+\b([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\b'
category: auth_token
label: splunk_hec_token
- kind: allow
values:
- "splunk"
- "splunk.com"
- "splunkcloud.com"
- "localhost:8089"
- "localhost:8000"
- "localhost:8088"
- "127.0.0.1:8089"
- "true"
- "false"
- "yes"
- "no"
- "null"
- "none"
- "nil"
- "0"
- "1"
- "localhost"
- "127.0.0.1"
- "0.0.0.0"
- "::1"
- "changeme"
- "example"
- "sample"
- "placeholder"
- "${*}"
- "{{*}}"
- "example.com"
- "example.org"