Splunk (v4.3.3)
Fetch events as incidents and search Splunk
- Author
- Cortex XSOAR
- Support
- xsoar
- URL
- https://www.paloaltonetworks.com/cortex
- Default data source
- SplunkPy
- Categories
- Analytics & SIEM
Incident fields (31)
- Notable - ID
- Notable Drilldown
- Notable Owner
- Notable Status
- Notable Urgency
- Splunk Comments
- Splunk Consolidated Findings
- Splunk Dest Risk Object Type
- Splunk Dest Risk Score
- Splunk Disposition
- Splunk Drilldown
- Splunk ES Event Type
- Splunk Excluded Finding IDs
- Splunk Implicit Finding IDs
- Splunk Incident IDs
- Splunk Incident Origin
- Splunk Intermediate Finding IDs
- Splunk Investigation GUID
- Splunk Investigation ID
- Splunk Investigation Name
- Splunk Investigation Type
- Splunk Notable Reviewer
- Splunk Notes
- Splunk Risk Object
- Splunk Security Domain
- Splunk Sensitivity
- Splunk Status
- Splunk Urgency
- Successful Asset Enrichment
- Successful Drilldown Enrichment
- Successful Identity Enrichment
Integrations (2)
- SplunkPy
- SplunkPy v2
Layouts (3)
- Splunk Finding
- Splunk Investigation
- Splunk Notable Generic
Playbooks (2)
- Splunk Generic
- Splunk Indicator Hunting
Scripts (9)
- SplunkAddComment
- SplunkAddNote
- SplunkConvertCommentsToTable
- SplunkConvertConsolidatedFindingsToMD
- SplunkConvertNotesToTable
- SplunkPySearch
- SplunkShowAsset
- SplunkShowDrilldown
- SplunkShowIdentity
README
This content pack runs queries on Splunk servers and fetches events from both Splunk Enterprise Security (ES) and non-ES environments.
What does this pack do?
This pack includes two integrations designed for different Splunk ES versions:
SplunkPy
The primary integration for Splunk ES versions up to 8.1, which automatically fetches notable events from Splunk along with their context data. The integration provides the analyst with comprehensive incident information directly in the XSOAR/XSIAM console.
SplunkPy v2
Designed for Splunk ES version 8.2 and higher, supporting the new Splunk Enterprise Security architecture (Findings and Investigations).
Using the commands in these integrations, you can leverage the Splunk API capabilities, such as:
- Running SPL (Splunk Search Processing Language) queries
- Managing events
- Working with KV store collections (create, search, update, delete)
- Enriching events with Asset, Identity, and Drilldown data
- Managing indexes and submitting events
- Bi-directional mirroring between Splunk and Cortex XSOAR
Note:
When mirroring or fetching incidents between Splunk and Cortex XSOAR, you need to map Splunk users to Cortex XSOAR users.