Setting up enterprise AI governance add-ons

Requirements

• Splunk Enterprise 9.x or 10.x, or Splunk Cloud Platform (Victoria or Classic). The package passes AppInspect with the cloud, private_victoria, and private_classic tag sets.
• A Claude Enterprise organization.
• An enterprise API key created by a Claude Enterprise admin in the Anthropic Console. Scopes are selected when the key is created, so grant the ones covering the inputs you plan to use.
• Outbound HTTPS from the collection tier to https://api.anthropic.com, directly or through the optional per-account proxy.

Installing the add-on

Download the latest release and install it through Apps → Manage Apps → Install app from file on Splunk Enterprise, or through the self-service app install flow or Admin Config Service (ACS) on Splunk Cloud Platform.

On a single instance, one installation does everything.

Creating an index

Create a dedicated events index for the data. This guide uses claude.

Adding the account

In the add-on, go to Configuration → Account → Add. Give the account a name and paste your API key or keys. Keys are stored encrypted in the platform's credential store and are never written to logs. An HTTPS proxy URL can be set per account if provider traffic has to leave through your egress proxy.

Creating inputs

Go to Inputs → Create New Input and create the inputs you need. Set Index on every input to the index you created.

Scoping the search macro

Go to Settings → Advanced search → Search macros and change the claude_index macro from its default of index=* to index=claude. Every dashboard and saved search in the add-on reads through this macro.

Verifying data is flowing

Wait one collection interval, then run:

sourcetype="anthropic:compliance:activity" earliest=-24h

The activity feed populates first. Analytics data is finalized by Anthropic with a lag of roughly three days, so the Usage & Spend Analytics dashboard will look empty on a Last 24 hours range even when everything is configured correctly. Check it on Last 7 days or Last 30 days.

If nothing appears, check the add-on's internal logs with index=_internal source=*anthropic_claude* (ERROR OR WARNING). A 401 or 403 means the key in use is missing a scope or was pasted incorrectly; the error message names the missing scope. Note that the Analytics key field overrides the compliance key when set, so clear it if it holds an old key. To force an immediate collection, disable the input and enable it again.

Requirements

• An enterprise ChatGPT account. The OpenAI Compliance API is available only to enterprise administrators.
• An API key generated by your organization administrator for the workspace you want to collect from. Review the OpenAI Compliance API documentation. Additional steps might be required to grant the key full API access.
• The workspace ID for that workspace.

Installing the add-on

Follow the standard Splunk add-on installation documentation for your deployment type:

• Install an add-on in a single-instance Splunk Enterprise deployment
• Install an add-on in a distributed Splunk Enterprise deployment
• Install an add-on in Splunk Cloud Platform

Download the packaged app from the releases page.

Adding the account

Open Splunk Web on the heavy forwarder or Inputs Data Manager (IDM), open the add-on, and go to Configuration → Account → Add. Enter the following:

• Account name. A unique name for this account.
• Workspace id. The workspace you want to collect data from.
• API key. The key generated for that workspace.
• Base URL. api.chatgpt.com for standard enterprise accounts, or gov.api.openai.com for FedRAMP accounts. A custom value can be typed directly.

Creating inputs

The add-on has two input types. Both implement checkpointing to avoid duplicate records.

OpenAI Compliance Data Input retrieves resource data. Create one input per endpoint you want.

OpenAI Compliance Logs Input retrieves log content. Select one or more event types on a single input, and set a From start date in the format YYYY-MM-DDTHH:MM:SSZ.

For each input, set a name, an interval, an index, and the account you created.

Verifying data is flowing

Wait one collection interval, then run:

sourcetype="openai:compliance:audit_log" earliest=-24h

If nothing appears, confirm the API key has the permissions required to access compliance data for the workspace ID you entered. If the key and workspace ID are both correct, check index=_internal source="*openai_compliance_addon_for_splunk_*" for error detail.

Requirements

• Splunk Cloud Platform, or Splunk Enterprise 10.x, standalone. Distributed and search head cluster deployments are designed for but not yet validated.
• HTTPS egress from the instance running the inputs to the provider APIs you enable.
• Admin-level API credentials for at least one provider.

Every permission above is a read scope. The only non-GET calls the add-on makes are OAuth token requests to Google and Microsoft, and a POST that opens a Microsoft Graph audit-log query job, which is how that API returns Purview records.

Installing the add-on

Download the latest release and install it following the Splunk add-on installation documentation. Install it on the search head, where dashboards, macros, alerts, and the modular inputs all run in the validated standalone topology. On Splunk Cloud Platform, install it as a private app through self-service app install or ACS.

Creating an index

Create an events index for the data. This guide uses ai_governance.

Adding provider accounts

Go to Configuration → AI Provider Accounts → Add, pick a provider, and enter its credentials. Add one account per provider, or one per organization or tenant if you have several. Secrets are stored encrypted in secure storage rather than in plain-text configuration files. Each account also accepts an optional proxy URL.

The screenshot below shows the Configuration page with the Add Account dialog open, where you select the provider from the dropdown and enter its credentials.

Creating inputs

Go to Inputs → Create New Input, pick an input type, select the account you created, and set Index to your index. Audit inputs backfill seven days of history on their first run by default, so dashboards populate immediately instead of filling in over the following week.

The screenshot below shows the Inputs page with a set of configured inputs across providers and the Create New Input dialog open.

OpenAI needs two inputs because it has two log planes with different credentials. openai_audit reads api.openai.com with a platform Admin API key and covers organization administration: keys minted, members invited, projects changed. openai_compliance reads the ChatGPT Enterprise Compliance Logs Platform on api.chatgpt.com with a Compliance API key and covers what users did in ChatGPT. Create both if you need both views.

Inputs checkpoint to the KV Store collection ta_ai_governance_checkpoints, so they resume cleanly across restarts.

Pointing the aigov_index macro at your index

Every dashboard, macro, and alert builds on one search macro. Go to Settings → Advanced search → Search macros in the TA-ai-governance app context, edit aigov_index, and set its definition to index=ai_governance.

Verifying data is flowing

Wait one collection interval, then run:

| tstats count where index=ai_governance BY sourcetype

Then open the dashboards from the app navigation bar, starting with AI Governance Overview. The category macros aigov_all, aigov_audit, aigov_directory, aigov_usage, aigov_cost, and aigov_selfhosted, and the cross-provider action macros aigov_signin_actions, aigov_admin_actions, aigov_key_actions, and aigov_export_actions, are there for building your own searches and reports.

Enabling the alerts that match your policy

Go to Settings → Searches, reports, and alerts in the TA-ai-governance app context. All eight alerts are disabled by default. Tune the thresholds for your environment, then enable the ones you want: API Key Created or Deleted, Admin or SSO Configuration Change, Data Export Activity, New AI User Seen, Off-Hours Activity Spike, Daily Spend Threshold Exceeded, New Self-Hosted Model Detected, and Self-Hosted Server Down.

The Anthropic Claude Enterprise Add-on includes six detections the same way, disabled by default, under Settings → Searches, reports, and alerts in that add-on's context: multi-IP user activity, access failures, SSO configuration change, data export started, top cost users, and users near spend limit.