SplunkPyPreRelease

Runs queries on Splunk servers.

Category

Analytics & SIEM

Pack

SplunkPyPreRelease

Configuration parameters

• host — Host - IP (x.x.x.x) (required)
• authentication — Username (required)
• port — Port (required)
• fetchQuery — Fetch events query
• fetch_limit — Fetch Limit (Max.- 200, Recommended less than 50)
• isFetch — Fetch incidents
• incidentType — Incident type
• useSplunkTime — Use Splunk Clock Time For Fetch
• parseNotableEventsRaw — Parse Raw Part of Notable Events
• replaceKeys — Replace with Underscore in Incident Fields
• timezone — Timezone of the Splunk server, in minutes. For example, if GMT is gmt +3, set timezone to +180. For UTC, set the timezone to 0. (Set only if the Splunk server is different than the Cortex XSOAR server.) Relevant only for fetching and mirroring notable events.
• fetch_time — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year)
• earliest_fetch_time_fieldname — Earliest time to fetch (The name of the Splunk field whose value defines the query's earliest time to fetch.)
• latest_fetch_time_fieldname — Latest time to fetch (The name of the Splunk field whose value defines the query's latest time to fetch.)
• extractFields — Extract Fields - CSV fields that will be parsed out of _raw notable events
• type_field — Event Type Field
• use_cim — Use CIM Schemas for Mapping
• mirror_direction — Incident Mirroring Direction
• close_incident — Close Mirrored XSOAR Incident
• close_notable — Close Mirrored Splunk Notable Event
• unsecure — Trust any certificate (not secure)
• proxy — Use system proxy settings
• app — The app context of the namespace
• hec_token — HEC Token (HTTP Event Collector)
• hec_url — HEC URL (e.g: https://localhost:8088).
• use_requests_handler — Use Python requests handler
• enabled_enrichments — Enrichment Types
• enrichment_timeout — Enrichment Timeout (Minutes)
• num_enrichment_events — Number of Events Per Enrichment Type
• extensive_logs — Advanced: Extensive logging (for debugging purposes) - Please do not use this option unless advised otherwise.
• occurrence_look_behind — Advanced: Fetch backwards window for the events occurrence time
• unique_id_fields — Advanced: Unique ID fields

Commands (22)

• get-mapping-fields — Query Splunk to retrieve a list of sample alerts by alert type. Used for mapping fetched incidents through the Get Schema option.
• get-modified-remote-data — Gets the list of notable events that were modified since the last update. This command should be used for debugging purposes, and is available from Cortex XSOAR version 6.1.
• get-remote-data — Gets data from a notable event. This method does not update the current incident, and should be used for debugging purposes.
• splunk-get-indexes — Prints all Splunk index names.
• splunk-job-create — Creates a new search job in Splunk.
• splunk-job-status — Returns the status of a job.
• splunk-kv-store-collection-add-entries — Adds objects to a KV store utilizing the batch-save API.
• splunk-kv-store-collection-config — Configures the KV store fields.
• splunk-kv-store-collection-create — Creates a new KV store table.
• splunk-kv-store-collection-data-delete — Deletes all data within the specified KV store collection or collections.
• splunk-kv-store-collection-data-list — Lists all data within a specific KV store collection or collections.
• splunk-kv-store-collection-delete — Deletes the specified KV stores.
• splunk-kv-store-collection-delete-entry — Deletes the specified object in store. The search can be a basic key-value pair or a full query.
• splunk-kv-store-collection-search-entry — Searches for specific objects in a store. The search can be a basic key-value pair or a full query.
• splunk-kv-store-collections-list — Lists all collections for the specified application.
• splunk-notable-event-edit — Updates existing notable events in Splunk ES.
• splunk-parse-raw — Parses the raw part of the event.
• splunk-reset-enriching-fetch-mechanism — Resets the enrichment mechanism of fetched notables.
• splunk-results — Returns the results of a previous Splunk search. You can use this command in conjunction with the splunk-job-create command.
• splunk-search — Searches Splunk for events.
• splunk-submit-event — Creates a new event in Splunk.
• splunk-submit-event-hec — Sends events to an HTTP Event Collector using the Splunk platform JSON event protocol.