Question
Can a Cribl HEC Source receive events directly from a Continuous Access Evaluation Profile transmitter and perform the transmitter’s JWT and issuer validation?
Environment
- Cribl Stream or Cribl.Cloud
- Splunk HEC Source
- CAEP or Shared Signals Framework event transmitter
Answer
No. A Cribl HEC Source can receive the payload as an authenticated transport, but it is not a CAEP or SSF receiver.
HEC token authentication does not provide receiver-side validation of the CAEP security event token, including JWT signature validation, JWKS lookup, issuer trust, audience validation, expiration checks, or replay protection.
Place a CAEP/SSF-aware receiver or API gateway before Cribl. Perform protocol and token validation at that trust boundary, then forward the validated event payload to Cribl through HEC or another supported transport.
Additional Information
A successful HEC token check proves only that the request used a configured HEC credential. It does not prove that the CAEP token or event semantics were validated.