SplunkPy v2

Run queries on Splunk and fetch Splunk ES Findings and Investigations (Splunk ES 8.2+).

Category

Analytics & SIEM

Pack

SplunkPy

Configuration parameters

• server_url — Server URL (required)
• authentication — (required)
• fetchQuery — Fetch events query
• max_fetch — Fetch Limit (Max.- 200, Recommended less than 50)
• isFetch — Fetch incidents
• incidentType — Incident type
• parseFindingEventsRaw — Parse Raw Part of Finding Events
• replaceKeys — Replace with Underscore in Incident Fields
• first_fetch — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year)
• fetch_event_types — Event types to fetch
• investigations_first_fetch — First fetch timestamp (Investigations)
• investigations_fetch_query — Investigations fetch query
• investigations_max_fetch — Maximum investigations per fetch
• extractFields — Extract Fields - CSV fields that will be parsed out of raw finding events
• mirror_direction — Incident Mirroring Direction
• close_incident — Close Mirrored Cortex XSOAR Incidents (Incoming Mirroring)
• close_extra_labels — Additional Splunk status labels to close on mirror (Incoming Mirroring)
• close_end_status_statuses — Enable Splunk statuses marked as "End Status" to close on mirror (Incoming Mirroring)
• close_finding — Close Mirrored Splunk ES Events (Outgoing Mirroring)
• unsecure — Trust any certificate (not secure)
• proxy — Use system proxy settings
• app — The app context of the namespace
• enabled_enrichments — Enrichment Types
• asset_enrich_lookup_tables — Asset enrichment lookup tables
• identity_enrich_lookup_tables — Identity enrichment lookup tables
• enrichment_timeout — Enrichment Timeout (Minutes)
• num_enrichment_events — Number of Events Per Enrichment Type
• cred_hec_token —
• hec_url — HEC BASE URL (e.g: https://localhost:8088 or https://example.splunkcloud.com/).
• extensive_logs — Advanced: Extensive logging (for debugging purposes). Do not use this option unless advised otherwise.
• finding_time_source — Advanced: Time type to use when fetching events
• occurrence_look_behind — Advanced: Fetch backwards window for the events occurrence time (minutes)
• unique_id_fields — Advanced: Unique ID Fields
• userMapping — Enable user mapping
• user_map_lookup_name — Users Lookup table name
• xsoar_user_field — XSOAR user key
• splunk_user_field — SPLUNK user key
• note_tag_from_splunk — Note tag from Splunk
• note_tag_to_splunk — Note tag to Splunk
• incidentFetchInterval — Incidents Fetch Interval

Commands (33)

• get-mapping-fields — Query Splunk to retrieve a list of sample alerts by alert type. Used for mapping fetched incidents through the Get Schema option.
• get-modified-remote-data — Gets the list of finding events that were modified since the last update. This command should be used for debugging purposes, and is available from Cortex XSOAR version 6.1.
• splunk-configuration-file-create — Creates a new, empty configuration (.conf) file in the given Splunk app namespace.
• splunk-configuration-file-list — Lists the configuration (.conf) files available in the given Splunk app namespace.
• splunk-configuration-stanza-create — Creates a new stanza (configuration entry) in a Splunk .conf file, optionally with attributes.
• splunk-configuration-stanza-delete — Deletes a stanza (configuration entry) from a Splunk .conf file (for example, transforms.conf) via the Splunk REST API configuration endpoints. This is useful for cleaning up KV Store transformations that remain after deleting KV Store records. To identify the correct stanza for deletion, use the splunk-configuration-file-list and splunk-configuration-stanza-list commands. This command is potentially harmful as it irreversibly deletes a stanza from a .conf file.
• splunk-configuration-stanza-list — Lists the stanzas in a .conf file, or returns the key/value content of a single stanza when stanza_name is provided.
• splunk-configuration-stanza-update — Updates (upserts) attributes on an existing stanza in a Splunk .conf file.
• splunk-finding-event-edit — Updates existing finding events in Splunk ES.
• splunk-get-indexes — Prints all Splunk index names.
• splunk-get-username-by-xsoar-user — Returns the Splunk's username matching the given Cortex XSOAR's username.
• splunk-investigation-create — Creates a new investigation in Splunk Enterprise Security.
• splunk-investigation-list — Lists investigations from Splunk Enterprise Security.
• splunk-job-create — Creates a new search job in Splunk.
• splunk-job-share — Change job settings to share its results to all Splunk users, and change its TTL.
• splunk-job-status — Returns the status of a job.
• splunk-kv-store-collection-add-entries — Adds objects to a KV store utilizing the batch-save API.
• splunk-kv-store-collection-config — Configures the KV store fields.
• splunk-kv-store-collection-create — Creates a new KV store table.
• splunk-kv-store-collection-create-transform — Creates the KV store collection transform.
• splunk-kv-store-collection-data-delete — Deletes all data within the specified KV store collection or collections.
• splunk-kv-store-collection-data-list — Lists all data within a specific KV store collection or collections.
• splunk-kv-store-collection-delete — Deletes the specified KV stores.
• splunk-kv-store-collection-delete-entry — Deletes the specified object in store. The search can be a basic key-value pair or a full query.
• splunk-kv-store-collection-search-entry — Searches for specific objects in a store. The search can be a basic key-value pair or a full query.
• splunk-kv-store-collections-list — Lists all collections for the specified application.
• splunk-parse-raw — Parses the raw part of the event.
• splunk-reset-enriching-fetch-mechanism — Resets the enrichment mechanism of fetched findings.
• splunk-results — Returns the results of a previous Splunk search. You can use this command in conjunction with the splunk-job-create command.
• splunk-search — Searches Splunk for events. For human readable output, the table command is supported in the query argument. For example, `query=" * | table field1 field2 field3"` will generate a table with field1, field2, and field3 as headers.
• splunk-submit-event — Creates a new event in Splunk.
• splunk-submit-event-hec — Sends events to an HTTP Event Collector using the Splunk platform JSON event protocol.
• splunk-update-investigation — Updates existing investigations in Splunk ES. Supports updating fields such as owner, status, urgency, disposition, name, and description, adding a note, and appending finding IDs to the investigation. Note that `findings` (and `finding_times`) can only be used when exactly one investigation ID is provided in `event_ids`.