SplunkPy

Run queries on Splunk and fetch Notable Events (Splunk ES versions up to 8.2).

Category

Analytics & SIEM

Pack

SplunkPy

Configuration parameters

• host — Server URL (required)
• authentication — Username (required)
• port — Port (required)
• fetchQuery — Fetch events query
• fetch_limit — Fetch Limit (Max.- 200, Recommended less than 50)
• isFetch — Fetch incidents
• incidentType — Incident type
• useSplunkTime — Use Splunk Clock Time For Fetch
• parseNotableEventsRaw — Parse Raw Part of Notable Events
• replaceKeys — Replace with Underscore in Incident Fields
• timezone — Timezone of the Splunk server, in minutes. For example, if GMT is gmt +3, set timezone to +180. For UTC, set the timezone to 0. When the Splunk server and the integration instance are on the same timezone, set the timezone to 0. This is relevant only for fetching and mirroring notable events. It must be specified when mirroring is enabled.
• fetch_time — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year)
• extractFields — Extract Fields - CSV fields that will be parsed out of _raw notable events
• type_field — Event Type Field
• use_cim — Use CIM Schemas for Mapping
• mirror_direction — Incident Mirroring Direction
• close_incident — Close Mirrored Cortex XSOAR Incidents (Incoming Mirroring)
• close_extra_labels — Additional Splunk status labels to close on mirror (Incoming Mirroring)
• close_end_status_statuses — Enable Splunk statuses marked as "End Status" to close on mirror (Incoming Mirroring)
• close_notable — Close Mirrored Splunk Notable Events (Outgoing Mirroring)
• unsecure — Trust any certificate (not secure)
• proxy — Use system proxy settings
• app — The app context of the namespace
• cred_hec_token —
• hec_token — HEC Token (HTTP Event Collector)
• hec_url — HEC BASE URL (e.g: https://localhost:8088 or https://example.splunkcloud.com/).
• enabled_enrichments — Enrichment Types
• asset_enrich_lookup_tables — Asset enrichment lookup tables
• identity_enrich_lookup_tables — Identity enrichment lookup tables
• enrichment_timeout — Enrichment Timeout (Minutes)
• num_enrichment_events — Number of Events Per Enrichment Type
• extensive_logs — Advanced: Extensive logging (for debugging purposes). Do not use this option unless advised otherwise.
• notable_time_source — Advanced: Time type to use when fetching events
• occurrence_look_behind — Advanced: Fetch backwards window for the events occurrence time (minutes)
• unique_id_fields — Advanced: Unique ID fields
• userMapping — Enable user mapping
• user_map_lookup_name — Users Lookup table name
• xsoar_user_field — XSOAR user key
• splunk_user_field — SPLUNK user key
• incidentFetchInterval — Incidents Fetch Interval
• comment_tag_from_splunk — Comment tag from Splunk
• comment_tag_to_splunk — Comment tag to Splunk

Commands (25)

• get-mapping-fields — Query Splunk to retrieve a list of sample alerts by alert type. Used for mapping fetched incidents through the Get Schema option.
• get-modified-remote-data — Gets the list of notable events that were modified since the last update. This command should be used for debugging purposes, and is available from Cortex XSOAR version 6.1.
• get-remote-data — Gets data from a notable event. This method does not update the current incident, and should be used for debugging purposes.
• splunk-get-indexes — Prints all Splunk index names.
• splunk-get-username-by-xsoar-user — Returns the Splunk's username matching the given Cortex XSOAR's username.
• splunk-job-create — Creates a new search job in Splunk.
• splunk-job-share — Change job settings to share its results to all Splunk users, and change its TTL.
• splunk-job-status — Returns the status of a job.
• splunk-kv-store-collection-add-entries — Adds objects to a KV store utilizing the batch-save API.
• splunk-kv-store-collection-config — Configures the KV store fields.
• splunk-kv-store-collection-create — Creates a new KV store table.
• splunk-kv-store-collection-create-transform — Creates the KV store collection transform.
• splunk-kv-store-collection-data-delete — Deletes all data within the specified KV store collection or collections.
• splunk-kv-store-collection-data-list — Lists all data within a specific KV store collection or collections.
• splunk-kv-store-collection-delete — Deletes the specified KV stores.
• splunk-kv-store-collection-delete-entry — Deletes the specified object in store. The search can be a basic key-value pair or a full query.
• splunk-kv-store-collection-search-entry — Searches for specific objects in a store. The search can be a basic key-value pair or a full query.
• splunk-kv-store-collections-list — Lists all collections for the specified application.
• splunk-notable-event-edit — Updates existing notable events in Splunk ES.
• splunk-parse-raw — Parses the raw part of the event.
• splunk-reset-enriching-fetch-mechanism — Resets the enrichment mechanism of fetched notables.
• splunk-results — Returns the results of a previous Splunk search. You can use this command in conjunction with the splunk-job-create command.
• splunk-search — Searches Splunk for events. For human readable output, the table command is supported in the query argument. For example, `query=" * | table field1 field2 field3"` will generate a table with field1, field2, and field3 as headers.
• splunk-submit-event — Creates a new event in Splunk.
• splunk-submit-event-hec — Sends events to an HTTP Event Collector using the Splunk platform JSON event protocol.