AirWatch and Splunk: Unified security visibility

AirWatch, the enterprise mobility management platform now associated with VMware, helps organisations configure, monitor and support managed phones, tablets and laptops. Its records reveal which endpoints meet policy, which applications are installed and whether essential security controls remain active. Splunk adds powerful search, correlation and alerting to those records, transforming endpoint activity into security intelligence that analysts can investigate and act upon.

The value comes from connecting endpoint context to the wider security picture. A compliance change becomes more significant when teams can identify the affected device, user and application involved in the preceding events. Australian organisations must also accommodate Essential Eight expectations, privacy obligations and distributed workforces spanning cities and regions. A well-designed integration creates usable visibility without introducing another information silo or an overwhelming stream of alerts.

Why endpoint logs need a wider security context

A managed mobility programme generates telemetry from device enrollment, application installation, policy evaluation, administrative actions and agent connectivity. These signals help IT teams understand fleet health, yet they often remain inside the mobility console. Security teams may need to connect that information with identity, firewall, cloud and ticketing data to establish what happened and why it matters.

Splunk provides a central platform for searching and correlating those data sources. Its dashboards, historical analysis and detection rules can reveal patterns that are difficult to spot within individual management screens. For example, analysts can identify a device that repeatedly falls out of compliance, links that change to a new administrator and subsequent access to a sensitive application. Endpoint records become useful evidence rather than isolated status messages.

The combination supports a practical division of responsibility. AirWatch remains the control point for endpoint management and policy enforcement, while Splunk handles large-scale event analysis. Clear ownership of ingestion, field definitions, alert handling and response actions prevents the integration from becoming an ambiguous shared system. It also gives business leaders measurable evidence about device risk and the effectiveness of mobile security controls.

Build a reliable event pipeline

Start with the integration path supported by your AirWatch deployment and Splunk environment. Depending on the console edition, hosting model and licensing, teams may use the Splunk add-on for VMware Workspace ONE, formerly AirWatch, or a documented event-forwarding method. A small proof of ingestion should confirm which sources are available, how events are structured and whether administrative records arrive separately from device state updates.

Collection can use HTTP Event Collector, syslog or a supported API-based export. Each source needs a named index, appropriate sourcetypes and consistent tags for organisation, business unit and device ownership. Time synchronisation is equally important: normalise timestamps to a common format, retain the original value where useful and monitor for gaps. Duplicate delivery can distort event counts and produce misleading alerts.

Data quality should be assessed before operational use. Compare the volume arriving in Splunk with the source console, examine missing identifiers and check whether changes appear as separate events. Retries, outages and overloaded collectors can otherwise create false confidence. A documented ingestion schedule tells teams when a source is delayed, which alerts require investigation and who can restore a broken collection path.

Map records before writing detections

Endpoint records must refer to the same device, application and user before analysts can join them confidently. Select a canonical device identifier, then preserve serial numbers, enrollment IDs, user email addresses and asset labels as searchable attributes. This avoids treating a renamed device as a new endpoint. Application names, versions and publishers require similar treatment because deployments often use local names that differ from the names displayed in AirWatch.

Teams can use a record matching guide as a reference when documenting how separate identifiers are combined. Document the matching rules, record exceptions and identify ambiguous cases. The same discipline applies to action values: distinguish successful changes from attempted changes, and define how unknown events should be handled rather than silently classifying them as harmless.

Mapping the data to Splunk Common Information Model data models, such as Endpoint, Authentication and Change, improves its usefulness alongside other security information. A field dictionary should record each AirWatch event type, its Splunk equivalent, permitted transformations and known gaps. Security rules can then run against consistent fields, while engineers can trace a questionable result back to its source record.

Turn telemetry into security action

A strong first detection joins device posture with relevant activity. For instance, a rule could identify a non-compliant endpoint that installs an application outside the approved list before attempting to reach a restricted resource. Another could highlight unusual administrative changes affecting enrollment or policy exemptions. These combinations provide more context than a standalone compliance alert and give responders a clear reason to investigate.

Alert routing should reflect operational ownership. An endpoint-policy warning may belong with the mobility team, while an account takeover pattern may belong with the security operations team. Shared tickets can include the device identifier, relevant event sequence, affected user and recommended next action. Where supported, Splunk can create enrichment tasks or launch approved workflow steps, although disruptive actions such as remote wipe should retain human oversight.

Teams should measure whether the integration improves decisions rather than merely increasing event volume. Useful measures include the percentage of priority devices reporting, ingestion delay, false-positive rates, investigation time and the proportion of alerts that lead to a documented response. Tuning rules with real Australian operating conditions helps keep attention focused on meaningful risks and reduces the likelihood that valuable signals will be ignored.

Design for Australian compliance and operations

The Australian Signals Directorate’s Essential Eight provides a useful reference for assessing controls around endpoint protection, access administration, vulnerability management and logging. An AirWatch and Splunk integration can supply evidence about device state and administrative events, but a green status alone does not demonstrate that a control works. Australian organisations should align retention, investigation and remediation practices with the risks they actually face.

Organisations regulated by the Australian Prudential Regulation Authority must also consider CPS 234 when assessing the security of their information assets. Endpoint and security logs may form part of the protected information environment, depending on the organisation and its systems. Finance-sector teams in Sydney, Melbourne and other Australian centres should assign clear responsibilities for log integrity, access, resilience and testing rather than leaving these requirements with the platform implementation team alone.

Privacy requirements shape what the integration should collect. The Australian Privacy Principles and Office of the Australian Information Commissioner guidance reinforce data minimisation, security and accountability. Endpoint telemetry can remain focused on identifiers, configurations and operational events without ingesting message content, browsing histories or full application files. Retention periods and access rights should reflect a defined business need, and any overseas support access should be documented.

Australian cloud regions around Sydney and Melbourne give many organisations additional choices for hosting and failover. Teams should evaluate those options, then verify the selected service’s actual data location, support model and contractual commitments. Distributed workforces also make location data relevant to detections, while demanding careful handling. An apparent change of city can indicate travel or a suspicious sign-in, but network-based location is approximate and should not become a substitute for identity verification.

Customs and border-security work creates a concrete risk of inspection, delay and device loss during travel. Organisations supporting Australian Customs and Border Face or comparable supply chains may need auditable evidence of device ownership, encryption posture and remote-wipe readiness. Local managed service providers can help package these controls for Australian enterprises across finance, logistics, field services and government contracting without assuming that every workforce follows the same working pattern.

Turn a pilot into operational value

Use a focused pilot to prove one complete workflow, from AirWatch event collection through Splunk detection and a documented response. The fully functional 30-day free trial provides an opportunity to test realistic device events and assess practical coverage. A useful pilot includes managed and unmanaged edge cases, policy changes, application activity and administrative events, so the team can distinguish a working integration from a healthy-looking dashboard.

Establish governance during the trial. Assign owners for AirWatch policy, Splunk ingestion, detection engineering and security response. Record which events are essential, where they are retained and how source outages are handled. Review the resulting rules with operational teams, then expand them gradually. Customer stories and deployment references can help identify comparable use cases, while pricing and package comparisons provide a clearer basis for planning adoption across business units.

Contact the sales team to scope the trial, select an appropriate package and define a controlled rollout for your organisation. Begin with one high-value use case, a named owner and an agreed measure of success, then build the operating model around evidence that matters.