AI Governance Add-on for Splunk (TA-ai-governance)

Version 1.0.2 · Splunk Enterprise 9.x & Splunk Cloud · Python 3 · Apache-2.0

Collect audit, directory, usage and cost data from enterprise AI platforms into Splunk — one add-on, one normalized schema, provider-agnostic dashboards and alerts. Use Splunk as the control plane for AI governance: security monitoring, compliance auditing, usage & cost visibility, and incident investigation across every LLM platform your organization uses.

In a hurry? See QUICKSTART.md — zero to dashboards in about 15 minutes.

---

Supported providers

Provider	Data collected	Inputs
Anthropic Claude Enterprise	Compliance API activity feed; users & groups directory; usage, cost & adoption analytics	anthropic_compliance, anthropic_analytics
OpenAI (ChatGPT Enterprise / API Platform)	Organization audit logs (50+ event types); user directory; aggregated token usage; daily costs	openai_audit, openai_usage
Google Gemini (Workspace)	Admin SDK Reports API Gemini audit events (gemini_in_workspace_apps)	gemini_audit
Microsoft 365 Copilot	Purview audit records (copilotInteraction) via Microsoft Graph; per-user usage reports	copilot_audit, copilot_usage
Self-hosted LLM servers (vLLM, Ollama, LiteLLM, any OpenAI-compatible)	Model inventory, Prometheus metrics, runtime info, health checks	selfhosted_monitor

Repository layout

.
├── README.md / QUICKSTART.md      # you are here
└── TA-ai-governance/              # the Splunk add-on — package and install this
    ├── app.manifest
    ├── bin/                       # modular inputs + shared ai_governance Python package
    ├── default/                   # conf files, dashboards, alerts, macros
    ├── lib/                       # bundled Python dependencies (solnlib, splunktaucclib, splunk-sdk)
    ├── README/                    # .conf.spec reference files
    └── static/                    # app icons

How it works

• Modular inputs — one input type per data domain per provider. Run them on a standalone search head, or on a heavy forwarder / IDM in distributed deployments.
• Provider adapters (bin/ai_governance/providers/) call each vendor API over HTTPS with certificate verification. An optional per-account proxy URL is supported.
• Normalized schema — every event carries aigov_provider, aigov_product, aigov_category, aigov_action, aigov_user, and aigov_src_ip, so dashboards, macros and alerts work identically across providers.
• KV Store checkpoints (collection ta_ai_governance_checkpoints) — inputs resume where they left off across restarts; search head clustering is supported.
• Encrypted credentials — all API keys and secrets are stored in Splunk secure storage, never in plain-text conf files.
• Config UI — a Configuration page for provider accounts and logging, and an Inputs page for creating and managing inputs, both built into the app.

Data reference

Inputs and default schedules

Input	Collects	Default interval	Default options
anthropic_compliance	Activity feed + users/groups directory	5 min	7-day backfill, 2 000 events/cycle
anthropic_analytics	Usage, cost and adoption summaries	24 h	7-day lookback
openai_audit	Org audit logs + user directory	5 min	7-day backfill, 2 000 events/cycle
openai_usage	Token usage + daily costs	24 h	7-day lookback, 1-day buckets
gemini_audit	Workspace Gemini audit events	10 min	7-day backfill, 5 000 events/cycle
copilot_audit	Purview copilotInteraction records	15 min	7-day backfill
copilot_usage	Per-user Copilot usage reports	24 h	7-day period
selfhosted_monitor	Models, metrics, runtime, health	5 min	scrapes /metrics (vLLM/LiteLLM/Ollama prefixes)

Sourcetypes

Provider	Sourcetypes
Anthropic	anthropic:compliance:activity, anthropic:compliance:user, anthropic:compliance:group, anthropic:analytics:usage, anthropic:analytics:cost, anthropic:analytics:summary (shared with the Anthropic Claude Enterprise Add-on)
OpenAI	aigov:openai:audit, aigov:openai:user, aigov:openai:usage, aigov:openai:cost
Google	aigov:gemini:audit
Microsoft	aigov:copilot:interaction, aigov:copilot:usage
Self-hosted	aigov:selfhosted:model, aigov:selfhosted:audit, aigov:selfhosted:metric, aigov:selfhosted:runtime, aigov:selfhosted:health

Search macros

All dashboards and alerts search through macros, so you configure the index exactly once:

Macro	Purpose
`aigov_index`	Set this to your index (ships as index=*) — everything else builds on it
`aigov_all`	All AI governance events across providers
`aigov_audit` / `aigov_directory` / `aigov_usage` / `aigov_cost` / `aigov_selfhosted`	Category slices
`aigov_signin_actions` / `aigov_admin_actions` / `aigov_key_actions` / `aigov_export_actions`	Cross-provider action groups used by alerts

Event types (aigov_audit_events, aigov_authentication_events, aigov_admin_change_events, aigov_usage_events, aigov_cost_events) are also provided for tagging and correlation.

Dashboards

Dashboard	Shows
AI Governance Overview (default)	Cross-provider activity, adoption and posture at a glance
AI Security Audit	Sign-ins, admin/SSO changes, API key lifecycle, data exports
AI Usage & Cost	Token usage, spend trends, per-user adoption
Self-Hosted AI	Model inventory, server health, runtime metrics
AI Compliance	Directory posture, activity-feed coverage

Alerts

Eight ready-made alerts ship disabled — enable the ones you want and tune thresholds:

• AI Governance – API Key Created or Deleted
• AI Governance – Admin or SSO Configuration Change
• AI Governance – Data Export Activity
• AI Governance – New AI User Seen
• AI Governance – Off-Hours Activity Spike
• AI Governance – Daily Spend Threshold Exceeded
• AI Governance – New Self-Hosted Model Detected
• AI Governance – Self-Hosted Server Down

Requirements

• Splunk — Splunk Cloud (vetted-app compatible, private app upload) or Splunk Enterprise 9.x, standalone or distributed (search head clustering supported).
• Python — Python 3 via the Splunk-bundled interpreter. All Python dependencies ship in lib/; nothing to install.
• Network — HTTPS egress from the instance running the inputs to the provider APIs you enable (or to your self-hosted LLM servers).
• Credentials — per provider; see the QUICKSTART for exact keys, scopes and permissions.

Installation

Full walkthrough in QUICKSTART.md. The short version:

1. Package TA-ai-governance (below) and install it — search head for standalone, search head plus the heavy forwarder / IDM that runs inputs for distributed.
2. Create an events index (e.g. ai_governance).
3. In the app: Configuration → AI Provider Accounts → Add, then Inputs → Create New Input.
4. Point the aigov_index macro at your index.

Packaging from source

git clone https://github.com/myeackcisco/cloud_llm_apis.git
cd cloud_llm_apis
COPYFILE_DISABLE=1 tar --exclude='.DS_Store' --exclude='__pycache__' \
  -czf TA-ai-governance-1.0.2.tar.gz TA-ai-governance

Upload the resulting .tar.gz via Apps → Manage Apps → Install app from file (or as a Splunk Cloud private app).

Troubleshooting

• Each input writes its own log: $SPLUNK_HOME/var/log/splunk/ta_ai_governance_<input_name>.log, searchable with index=_internal source=*ta_ai_governance*.
• Change verbosity under Configuration → Logging in the app.
• Empty dashboards almost always mean the aigov_index macro still points at the default — see QUICKSTART troubleshooting for the full checklist.

Security notes

• Credentials are encrypted with Splunk secure storage; the account form never writes secrets to conf files.
• All outbound calls use HTTPS with certificate verification. Self-hosted monitoring may opt into plain HTTP explicitly (lab use) per account.
• An optional per-account proxy URL routes provider traffic through your egress proxy.

License

Apache License 2.0 — see TA-ai-governance/LICENSES/Apache-2.0.txt. This add-on is provided as-is.