category: Analytics & SIEM
provider: Cisco Systems
commonfields:
  id: SplunkPy v2
  version: -1
sectionorder:
- Connect
- Collect
configuration:
- display: Server URL
  name: server_url
  required: true
  type: 0
  section: Connect
  defaultvalue: 'https://splunk.example.com'
  additionalinfo: "The Splunk server URL. Port 8089 (Splunk's default REST API port) is used automatically. Only include the port in the URL if using a non-default port. Examples: 'https://splunk.example.com' (uses default port 8089) or 'https://splunk.example.com:8090' (uses custom port 8090)."
- display: ""
  displaypassword: Splunk Token
  hiddenusername: true
  name: authentication
  required: true
  type: 9
  section: Connect
- additionalinfo: The Splunk search query by which to fetch events. The default query fetches ES finding events. You can edit this query to fetch other types of events. Note, that to fetch ES finding events, make sure to include the \`notable\` macro in your query.
  defaultvalue: search `notable` | eval rule_name=if(isnull(rule_name),source,rule_name) | eval rule_title=if(isnull(rule_title),rule_name,rule_title) | `get_urgency` | `risk_correlation` | eval rule_description=if(isnull(rule_description),source,rule_description) | eval security_domain=if(isnull(security_domain),source,security_domain) | expandtoken
  display: Fetch events query
  name: fetchQuery
  type: 0
  section: Collect
  required: false
- defaultvalue: '50'
  display: Fetch Limit (Max.- 200, Recommended less than 50)
  name: max_fetch
  type: 0
  section: Collect
  required: false
  supportedModules:
  - agentix
  - xsiam
- display: Fetch incidents
  name: isFetch
  type: 8
  section: Collect
  required: false
  supportedModules:
  - agentix
  - xsiam
- display: Incident type
  name: incidentType
  type: 13
  section: Collect
  required: false
  supportedModules:
  - agentix
  - xsiam
- defaultvalue: 'false'
  display: Parse Raw Part of Finding Events
  name: parseFindingEventsRaw
  type: 8
  section: Collect
  advanced: true
  required: false
  additionalinfo: Whether to parse the raw part of the Findings, or not.
- defaultvalue: 'false'
  display: Replace with Underscore in Incident Fields
  name: replaceKeys
  type: 8
  section: Collect
  advanced: true
  required: false
  additionalinfo: Whether to replace special characters to underscore when parsing the raw data of the Findings, or not.
- additionalinfo: The amount of time to go back when performing the first fetch, or when creating a mapping using the Select Schema option.
  defaultvalue: 10 minutes
  display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days, 3 months, 1 year)
  name: first_fetch
  type: 0
  section: Collect
  required: false
- display: Event types to fetch
  name: fetch_event_types
  type: 16
  section: Collect
  advanced: true
  required: false
  defaultvalue: Finding
  options:
  - Finding
  - Investigation
  additionalinfo: Select the Splunk event types to ingest. Default is `Finding`.
- display: First fetch timestamp (Investigations)
  name: investigations_first_fetch
  type: 0
  section: Collect
  advanced: true
  required: false
  defaultvalue: 10 minutes
  additionalinfo: The relative time interval to look back during the initial investigation fetch (for example, 12 hours, 7 days, 3 months).
- display: Investigations fetch query
  name: investigations_fetch_query
  type: 0
  section: Collect
  advanced: true
  required: false
  defaultvalue: |
    | rest "/servicesNS/nobody/missioncontrol/public/v2/investigations?search_format=true&FETCH_FILTER_PLACEHOLDER"
  additionalinfo: The SPL query used when "Investigation" is selected for "Event types to fetch". The query must include the `FETCH_FILTER_PLACEHOLDER` token. Do not modify or remove this token. For more information on customizing the query (for example, adding the filter &status=New), see the integration documentation under "Fetching investigation events".
- display: Maximum investigations per fetch
  name: investigations_max_fetch
  type: 0
  section: Collect
  advanced: true
  required: false
  defaultvalue: '50'
  additionalinfo: The maximum number of investigations to fetch per cycle. Limited to 100 by the Splunk investigations endpoint.
- display: Extract Fields - CSV fields that will be parsed out of raw finding events
  name: extractFields
  type: 0
  section: Collect
  advanced: true
  required: false
- additionalinfo: 'Choose the direction to mirror the incident: Incoming (from Splunk to Cortex XSOAR), Outgoing (from Cortex XSOAR to Splunk), or Incoming and Outgoing (from/to Cortex XSOAR and Splunk).'
  defaultvalue: None
  display: Incident Mirroring Direction
  name: mirror_direction
  options:
  - None
  - Incoming
  - Outgoing
  - Incoming And Outgoing
  type: 15
  section: Collect
  hidden:
  - marketplacev2
  - platform
  required: false
- additionalinfo: When selected, closing the Splunk finding event with a "Closed" status will close the Cortex XSOAR incident.
  defaultvalue: 'false'
  display: Close Mirrored Cortex XSOAR Incidents (Incoming Mirroring)
  name: close_incident
  type: 8
  section: Collect
  advanced: true
  hidden:
  - marketplacev2
  - platform
  required: false
- display: Additional Splunk status labels to close on mirror (Incoming Mirroring)
  name: close_extra_labels
  type: 0
  section: Collect
  advanced: true
  additionalinfo: "A comma-separated list of Splunk status labels to mirror as closed Cortex XSOAR incident (Example: Resolved,False-Positive)."
  required: false
- additionalinfo: When selected, automatically close the Cortex XSOAR incident when the Splunk ES event (Finding or Investigation) is marked as 'End Status'.
  defaultvalue: 'false'
  display: Enable Splunk statuses marked as "End Status" to close on mirror (Incoming Mirroring)
  name: close_end_status_statuses
  type: 8
  section: Collect
  advanced: true
  required: false
  hidden:
  - marketplacev2
  - platform
- display: Close Mirrored Splunk ES Events (Outgoing Mirroring)
  name: close_finding
  type: 8
  section: Collect
  advanced: true
  hidden:
  - marketplacev2
  - platform
  additionalinfo: When selected, automatically close the corresponding Splunk ES event (Finding or Investigation) when the Cortex XSOAR incident is closed.
  defaultvalue: 'false'
  required: false
- display: Trust any certificate (not secure)
  name: unsecure
  type: 8
  section: Connect
  advanced: true
  required: false
- name: proxy
  type: 8
  section: Connect
  advanced: true
  display: Use system proxy settings
  required: false
- display: 'The app context of the namespace'
  name: app
  type: 0
  section: Collect
  advanced: true
  required: false
- display: 'Enrichment Types'
  name: enabled_enrichments
  type: 16
  section: Collect
  advanced: true
  additionalinfo: Enrichment types to enrich each fetched finding. If none are selected, the integration will fetch findings as usual (without enrichment). For more info about enrichment types see the integration additional info.
  options:
  - Drilldown
  - Asset
  - Identity
  required: false
- additionalinfo: CSV of the Splunk lookup tables from which to take the Asset enrichment data.
  defaultvalue: asset_lookup_by_str,asset_lookup_by_cidr
  display: Asset enrichment lookup tables
  name: asset_enrich_lookup_tables
  type: 0
  required: false
  section: Collect
  advanced: true
- additionalinfo: CSV of the Splunk lookup tables from which to take the Identity enrichment data.
  defaultvalue: identity_lookup_expanded
  display: Identity enrichment lookup tables
  name: identity_enrich_lookup_tables
  type: 0
  required: false
  section: Collect
  advanced: true
- display: 'Enrichment Timeout (Minutes)'
  name: enrichment_timeout
  type: 0
  section: Collect
  advanced: true
  additionalinfo: When the selected timeout was reached, finding events that were not enriched will be saved without the enrichment.
  defaultvalue: '5'
  required: false
- additionalinfo: The limit of how many events to retrieve per each one of the enrichment types (Drilldown, Asset, and Identity). In a case of multiple drilldown enrichments the limit will apply for each drilldown search query. To retrieve all events, enter "0" (not recommended).
  display: 'Number of Events Per Enrichment Type'
  name: num_enrichment_events
  type: 0
  section: Collect
  advanced: true
  defaultvalue: '20'
  required: false
- name: cred_hec_token
  type: 9
  section: Collect
  advanced: true
  displaypassword: HEC Token (HTTP Event Collector)
  hiddenusername: true
  required: false
  display: ''
- display: 'HEC BASE URL (e.g: https://localhost:8088 or https://example.splunkcloud.com/).'
  name: hec_url
  type: 0
  section: Collect
  advanced: true
  required: false
- display: 'Advanced: Extensive logging (for debugging purposes). Do not use this option unless advised otherwise.'
  name: extensive_logs
  type: 8
  section: Collect
  advanced: true
  required: false
- display: 'Advanced: Time type to use when fetching events'
  name: finding_time_source
  type: 15
  defaultvalue: "creation time"
  options:
  - "creation time"
  - "index time (Beta)"
  additionalinfo: |
    Defines which timestamp will be used to filter the events:
    - creation time: Filters based on when the event actually occurred.
    - index time (Beta): *Beta feature* – Filters based on when the event was ingested into Splunk.  
      This option is still in testing and may not behave as expected in all scenarios.  
      When using this mode, the parameter "Fetch backwards window for the events occurrence time (minutes)" should be set to `0``, as indexing time ensures there are no delay-based gaps.
      The default is "creation time".
  section: Collect
  advanced: true
  required: false
- defaultvalue: '15'
  display: 'Advanced: Fetch backwards window for the events occurrence time (minutes)'
  name: occurrence_look_behind
  type: 0
  section: Collect
  advanced: true
  additionalinfo: The fetch time range will be at least the size specified here. This will support events that have a gap between their occurrence time and their index time in Splunk. To decide how long the backwards window should be, you need to determine the average time between them both in your Splunk environment.
  required: false
- display: 'Advanced: Unique ID Fields'
  name: unique_id_fields
  type: 0
  section: Collect
  advanced: true
  required: false
  additionalinfo: 'A comma-separated list of additional fields to use when generating unique incident IDs for events that are not findings (i.e., queries without the `notable` macro). By default, the integration uses: _cd, index, _time, _indextime, _raw. If these fields do not provide unique values in your environment, specify additional fields here to ensure incident uniqueness. Example: source,host,unique_field'
- defaultvalue: 'false'
  display: Enable user mapping
  name: userMapping
  type: 8
  section: Collect
  advanced: true
  required: false
  additionalinfo: Whether to enable the user mapping between Cortex XSOAR and Splunk, or not. For more information see https://xsoar.pan.dev/docs/reference/integrations/splunk-py#configure-user-mapping-between-splunk-and-cortex-xsoar
- defaultvalue: 'splunk_xsoar_users'
  display: Users Lookup table name
  name: user_map_lookup_name
  type: 0
  section: Collect
  advanced: true
  additionalinfo: The name of the lookup table in Splunk, containing the username's mapping data.
  required: false
- defaultvalue: 'xsoar_username'
  display: XSOAR user key
  name: xsoar_user_field
  type: 0
  section: Collect
  advanced: true
  additionalinfo: The name of the lookup column containing the Cortex XSOAR username.
  required: false
- defaultvalue: 'splunk_username'
  display: SPLUNK user key
  name: splunk_user_field
  type: 0
  section: Collect
  advanced: true
  additionalinfo: The name of the lookup table containing the Splunk username.
  required: false
- display: Note tag from Splunk
  name: note_tag_from_splunk
  defaultvalue: FROM SPLUNK
  type: 0
  section: Collect
  advanced: true
  required: false
  additionalinfo: Add this tag to an entry to mirror it as a note from Splunk.
- display: Note tag to Splunk
  name: note_tag_to_splunk
  defaultvalue: FROM XSOAR
  type: 0
  section: Collect
  advanced: true
  required: false
  additionalinfo: Add this tag to an entry to mirror it as a note to Splunk.
- defaultvalue: '1'
  display: Incidents Fetch Interval
  name: incidentFetchInterval
  type: 19
  section: Collect
  advanced: true
  required: false
  supportedModules:
  - agentix
  - xsiam
description: Run queries on Splunk and fetch Splunk ES Findings and Investigations (Splunk ES 8.2+).
display: SplunkPy v2
name: SplunkPy v2
script:
  commands:
  - arguments:
    - default: true
      description: ID of the search for which to return results.
      name: sid
      required: true
    - defaultValue: '100'
      description: The maximum number of returned results per search. To retrieve all results, enter "0" (not recommended).
      name: limit
    description: Returns the results of a previous Splunk search. You can use this command in conjunction with the splunk-job-create command.
    name: splunk-results
  - arguments:
    - default: true
      description: 'The Splunk search language string to execute. For example: "index=* | head 3". '
      name: query
      required: true
    - description: 'Specifies the earliest time in the time range to search. The time string can be a UTC time (with fractional seconds), a relative time specifier (to now), or a formatted time string. Default is 1 week ago, in the format "-7d". You can also specify time in the format: 2014-06-19T12:00:00.000-07:00.'
      name: earliest_time
    - description: 'Specifies the latest time in the time range to search. The time string can be a UTC time (with fractional seconds), a relative time specifier (to now), or a formatted time string. For example: "2014-06-19T12:00:00.000-07:00" or "-3d" (for 3 days ago).'
      name: latest_time
    - description: Maximum number of events to return. Default is 100. If "0", all results are returned.
      name: event_limit
    - defaultValue: '25000'
      description: The maximum number of returned results to process at a time. For example, if 100 results are returned, and you specify a batch_limit of 10, the results will be processed 10 at a time over 10 iterations. This does not effect the search or the context and outputs returned. In some cases, specifying a batch_size enhances search performance. If you think that the search execution is suboptimal, we recommend trying several batch_size values to determine which works best for your search. Default is 25,000.
      name: batch_limit
    - auto: PREDEFINED
      defaultValue: 'true'
      description: 'Determines whether the results will be entered into the context. Possible values: "true" and "false".'
      name: update_context
      predefined:
      - 'true'
      - 'false'
    - description: A string that contains the application namespace in which to restrict searches.
      name: app
    - auto: PREDEFINED
      description: Use XSOAR built-in polling to retrieve the result when it's ready.
      name: polling
      predefined:
      - 'true'
      - 'false'
    - defaultValue: '30'
      description: Interval in seconds between each poll.
      name: interval_in_seconds
    - description: The job sid.
      name: sid
    - auto: PREDEFINED
      defaultValue: 'false'
      description: The Fast mode prioritizes the performance of the search and does not return nonessential field or event data. This means that the search returns what is essential and required if fast_mode equals 'true'.
      name: fast_mode
      predefined:
      - 'true'
      - 'false'
    description: Searches Splunk for events. For human readable output, the table command is supported in the query argument. For example, `query=" * | table field1 field2 field3"` will generate a table with field1, field2, and field3 as headers.
    name: splunk-search
    polling: true
    outputs:
    - contextPath: Splunk.Result
      description: The results of the Splunk search. The results are a JSON array, in which each item is a Splunk event.
      type: Unknown
    - contextPath: Splunk.JobStatus.SID
      description: ID of the job.
      type: String
    - contextPath: Splunk.JobStatus.Status
      description: Status of the job.
      type: String
    - contextPath: Splunk.JobStatus.TotalResults
      description: The number of events that were returned by the job.
      type: String
  - arguments:
    - description: Splunk index in which to push data. Run the splunk-get-indexes command to get all indexes.
      name: index
      required: true
    - default: true
      description: The new event data to push. Can be any string.
      name: data
      required: true
    - description: Event source type.
      name: sourcetype
      required: true
    - description: Event host. Can be "Local" or "120.0.0.1".
      name: host
      required: true
    description: Creates a new event in Splunk.
    name: splunk-submit-event
  - description: Prints all Splunk index names.
    name: splunk-get-indexes
    arguments: []
  - arguments:
    - description: A comma-separated list of event IDs of finding events.
      name: event_ids
      required: true
      isArray: true
    - description: A Splunk user to assign to the finding events.
      name: owner
    - description: Note to add to the finding events.
      name: note
    - auto: PREDEFINED
      description: 'Finding event urgency. Possible values: "critical", "high", "medium", "low", and "informational".'
      name: urgency
      predefined:
      - critical
      - high
      - medium
      - low
      - informational
    - auto: PREDEFINED
      description: Finding event status.
      name: status
      predefined:
      - Unassigned
      - Assigned
      - In Progress
      - Pending
      - Resolved
      - Closed
    - name: disposition
      auto: PREDEFINED
      predefined:
      - Unassigned
      - True Positive - Suspicious Activity
      - Benign Positive - Suspicious But Expected
      - False Positive - Incorrect Analytic Logic
      - False Positive - Inaccurate Data
      - Other
      - Undetermined
      description: Disposition of the finding. If the more options exist on the server, specifying the disposition as `disposition:#` will work in place of choosing one of the default values from the list.
    - description: The time associated with the finding event (e.g., the `_time` field of the finding). Use this argument only when the command fails with error code MC_01202 or MC_0210, which indicate that the finding event time is required to complete the update.
      name: finding_time
    description: Updates existing finding events in Splunk ES.
    execution: true
    name: splunk-finding-event-edit
  - arguments:
    - description: A comma-separated list of investigation IDs.
      name: event_ids
      required: true
      isArray: true
    - description: The Splunk user to assign to the investigations.
      name: owner
    - description: The note to add to the investigation.
      name: note
    - name: disposition
      auto: PREDEFINED
      predefined:
      - Unassigned
      - True Positive - Suspicious Activity
      - Benign Positive - Suspicious But Expected
      - False Positive - Incorrect Analytic Logic
      - False Positive - Inaccurate Data
      - Other
      - Undetermined
      description: The disposition to set for the investigation. To use a custom disposition not available in the dropdown, provide the numerical ID using the format disposition:# (for example, disposition:12).
    - auto: PREDEFINED
      description: The investigation status.
      name: status
      predefined:
      - New
      - Unassigned
      - In progress
      - Pending
      - Resolved
      - Closed
    - auto: PREDEFINED
      description: 'The investigation urgency. Possible values: "critical", "high", "medium", "low", and "informational".'
      name: urgency
      predefined:
      - critical
      - high
      - medium
      - low
      - informational
    - description: Updated name for the investigation.
      name: name
    - description: Updated description for the investigation.
      name: description
    - description: Comma-separated list of finding IDs to add (append) to the investigation. Only allowed when exactly one investigation ID is provided in `event_ids`.
      name: findings
      isArray: true
    - description: The list of times for findings added to the investigation. Value can be in relative, ISO, or epoch time. Ignored when `findings` is not provided. Only allowed when exactly one investigation ID is provided in `event_ids`.
      name: finding_times
      isArray: true
    description: Updates existing investigations in Splunk ES. Supports updating fields such as owner, status, urgency, disposition, name, and description, adding a note, and appending finding IDs to the investigation. Note that `findings` (and `finding_times`) can only be used when exactly one investigation ID is provided in `event_ids`.
    execution: true
    name: splunk-update-investigation
  - arguments:
    - description: The Splunk search language string to execute. For example :"index=* | head 3".
      name: query
      required: true
    - description: A string that contains the application namespace in which to restrict searches.
      name: app
    description: Creates a new search job in Splunk.
    name: splunk-job-create
    outputs:
    - contextPath: Splunk.Job
      description: The SID of the created job.
      type: Unknown
  - arguments:
    - default: true
      defaultValue: ${Splunk.Result._raw}
      description: The raw data of the Splunk event (string).
      name: raw
    description: Parses the raw part of the event.
    name: splunk-parse-raw
    outputs:
    - contextPath: Splunk.Raw.Parsed
      description: The raw event data (parsed).
      type: unknown
  - arguments:
    - description: |-
        Event payload key-value pair.
        String example: "event": "Access log test message".
      name: event
    - description: Fields for indexing that do not occur in the event payload itself. Accepts multiple, comma-separated, fields.
      name: fields
    - description: The index name.
      name: index
    - description: The hostname.
      name: host
    - description: User-defined event source type.
      name: source_type
    - description: User-defined event source.
      name: source
    - description: Epoch-formatted time.
      name: time
    - description: A channel identifier (ID) where to send the request, must be a Globally Unique Identifier (GUID). If the indexer acknowledgment is turned on, a channel is required.
      name: request_channel
    - description: 'A  batch of events to send to Splunk. For example, `{"event": "something happened at 14/10/2024 12:29", "fields": {"severity": "INFO", "category": "test2, test2"}, "index": "index0","sourcetype": "sourcetype0","source": "/example/something" } {"event": "something happened at 14/10/2024 13:29", "index": "index1", "sourcetype": "sourcetype1","source": "/example/something", "fields":{ "fields" : "severity: INFO, category: test2, test2"}}`. If provided all arguments except of `request_channel` are ignored.'
      name: batch_event_data
    - description: The entry ID in Cortex XSOAR of the file containing a batch of events. If provided, the arguments related to a single event are ignored.
      name: entry_id
    description: Sends events to an HTTP Event Collector using the Splunk platform JSON event protocol.
    name: splunk-submit-event-hec
  - arguments:
    - description: Comma-separated list of job IDs for which to retrieve the statuses.
      name: sid
      required: true
      isArray: true
    description: Returns the status of a job.
    name: splunk-job-status
    outputs:
    - contextPath: Splunk.JobStatus.SID
      description: ID of the job.
      type: String
    - contextPath: Splunk.JobStatus.Status
      description: Status of the job.
      type: String
  - arguments:
    - description: The name of the KV store collection.
      name: kv_store_name
      required: true
    - default: true
      defaultValue: search
      description: The name of the Splunk application in which to create the KV store. The default is "search".
      name: app_name
      required: true
    description: Creates a new KV store table.
    name: splunk-kv-store-collection-create
  - arguments:
    - description: The name of the KV store collection.
      name: kv_store_collection_name
      required: true
    - description: |
        The list of names and value types used to define the KV store collection scheme, e.g., id=number, name=string, address=string.
      isArray: true
      name: kv_store_fields
      required: true
    - default: true
      defaultValue: search
      description: The name of the Splunk application that contains the KV store collection. The default is "search".
      name: app_name
      required: true
    description: Configures the KV store fields.
    name: splunk-kv-store-collection-config
  - arguments:
    - description: The name of the KV store collection.
      name: kv_store_collection_name
      required: true
    - description: |
        A comma-delimited list of the fields supported by the collection, e.g., _key,id,name,address. If no value is specified, the KV Store collection configuration will be used.
      name: supported_fields
    - default: true
      defaultValue: search
      description: The name of the Splunk application that contains the KV store collection.
      name: app_name
      required: true
    description: Creates the KV store collection transform.
    name: splunk-kv-store-collection-create-transform
  - arguments:
    - description: 'The data to add to the KV store collection, according to the collection JSON format, e.g., [{"name": "Splunk HQ", "id": 456, "address": { "street": "340 Brannan Street", "city": "San Francisco", "state": "CA", "zip": "121212"}}, {"name": "Splunk HQ", "id": 123, "address": { "street": "250 Brannan Street", "city": "San Francisco", "state": "CA", "zip": "94107"}}].'
      name: kv_store_data
      required: true
    - description: The name of the KV store collection.
      name: kv_store_collection_name
      required: true
    - description: The path to the indicator value in kv_store_data.
      name: indicator_path
    - default: true
      defaultValue: search
      description: The name of the Splunk application that contains the KV store collection. The default is "search".
      name: app_name
      required: true
    description: Adds objects to a KV store utilizing the batch-save API.
    name: splunk-kv-store-collection-add-entries
  - arguments:
    - default: true
      defaultValue: search
      description: The name of the Splunk application in which to create the KV store. The default is "search".
      name: app_name
      required: true
    description: Lists all collections for the specified application.
    name: splunk-kv-store-collections-list
    outputs:
    - contextPath: Splunk.CollectionList
      description: List of collections.
      type: String
  - arguments:
    - default: true
      defaultValue: search
      description: The name of the Splunk application that contains the KV store collection. The default is "search".
      name: app_name
      required: true
    - description: A comma-separated list of KV store collections.
      isArray: true
      name: kv_store_collection_name
      required: true
    - defaultValue: '50'
      description: Maximum number of records to return. The default is 50.
      name: limit
    description: Lists all data within a specific KV store collection or collections.
    name: splunk-kv-store-collection-data-list
    outputs:
    - contextPath: Splunk.KVstoreData
      description: An array of collection names. Each collection name will have an array of values, e.g., Splunk.KVstoreData.<collection_name> is a list of the data in the collection.
      type: Unknown
  - arguments:
    - default: true
      defaultValue: search
      description: The name of the Splunk application that contains the KV store collection. For example, "search".
      name: app_name
      required: true
    - description: A comma-separated list of KV store collections.
      isArray: true
      name: kv_store_collection_name
      required: true
    description: Deletes all data within the specified KV store collection or collections.
    name: splunk-kv-store-collection-data-delete
  - arguments:
    - default: true
      defaultValue: search
      description: The name of the Splunk application that contains the KV store. The default is "store".
      name: app_name
      required: true
    - description: A comma-separated list of KV stores.
      isArray: true
      name: kv_store_name
      required: true
    description: Deletes the specified KV stores.
    name: splunk-kv-store-collection-delete
  - arguments:
    - default: true
      defaultValue: search
      description: The name of the Splunk application that contains the KV store collection. The default is "search".
      name: app_name
      required: true
    - description: The name of the KV store collection.
      name: kv_store_collection_name
      required: true
    - description: The key name to search in the store. If the query argument is used, this argument will be ignored.
      name: key
    - description: The value to search in the store. If the query argument is used, this argument will be ignored.
      name: value
    - description: 'Complex query to search in the store with operators such as "and", "or", "not", etc. For more information, see the Splunk documentation: https://docs.splunk.com/Documentation/Splunk/8.0.3/RESTREF/RESTkvstore.'
      name: query
    description: Searches for specific objects in a store. The search can be a basic key-value pair or a full query.
    name: splunk-kv-store-collection-search-entry
    outputs:
    - contextPath: Splunk.KVstoreData
      description: An array of collection names. Each collection name will have an array of values, e.g., Splunk.KVstoreData.<collection_name> is a list of the data in the collection.
      type: Unknown
  - arguments:
    - default: true
      defaultValue: search
      description: The name of the Splunk application that contains the KV store collection. The default is "search".
      name: app_name
      required: true
    - description: The name of the KV store collection.
      name: kv_store_collection_name
      required: true
    - description: The path to the indicator value in kv_store_data.
      name: indicator_path
    - description: The key name to search in the store. If the query argument is used, this argument will be ignored.
      name: key
    - description: The value to search in the store. If the query argument is used, this argument will be ignored.
      name: value
    - description: |-
        Complex query to search in the store with operators such as "and", "or", "not", etc.
        For more information, see the Splunk documentation: https://docs.splunk.com/Documentation/Splunk/8.0.3/RESTREF/RESTkvstore.
      name: query
    description: Deletes the specified object in store. The search can be a basic key-value pair or a full query.
    name: splunk-kv-store-collection-delete-entry
  - arguments:
    - default: true
      defaultValue: search
      description: The name of the Splunk application namespace.
      name: app
      type: string
    - defaultValue: nobody
      description: The Access Control List (ACL) owner for the namespace.
      name: owner
      type: string
    - defaultValue: '50'
      description: The maximum number of configuration files to return. Range 1-500.
      name: limit
      type: number
    description: Lists the configuration (.conf) files available in the given Splunk app namespace.
    name: splunk-configuration-file-list
    outputs:
    - contextPath: Splunk.ConfigurationFile.FileName
      description: The configuration file name (without the .conf suffix).
      type: String
    - contextPath: Splunk.ConfigurationFile.App
      description: The Splunk app namespace the configuration file belongs to.
      type: String
  - arguments:
    - description: The name of the new configuration file to create (without the .conf extension).
      name: conf_file_name
      required: true
      type: string
    - default: true
      defaultValue: search
      description: The name of the Splunk application namespace in which to create the file.
      name: app
      type: string
    - defaultValue: nobody
      description: The Access Control List (ACL) owner for the namespace.
      name: owner
      type: string
    description: Creates a new, empty configuration (.conf) file in the given Splunk app namespace.
    name: splunk-configuration-file-create
  - arguments:
    - description: The configuration file name (without the .conf extension), for example, "transforms", "props", or "inputs".
      name: conf_file
      required: true
      type: string
    - description: The name of the new stanza to create.
      name: stanza_name
      required: true
      type: string
    - description: 'The JSON object string of attributes to set on creation, e.g., {"external_type": "kvstore", "collection": "my_collection"}. If omitted, an empty stanza is created.'
      name: key_value_pairs
      type: string
    - default: true
      defaultValue: search
      description: The name of the Splunk application namespace.
      name: app
      type: string
    - defaultValue: nobody
      description: The Access Control List (ACL) owner for the namespace.
      name: owner
      type: string
    description: Creates a new stanza (configuration entry) in a Splunk .conf file, optionally with attributes.
    name: splunk-configuration-stanza-create
  - arguments:
    - description: The configuration file name (without the .conf extension).
      name: conf_file
      required: true
      type: string
    - description: The name of the stanza to return. If provided, returns the key/value content of that single stanza. If omitted, returns the list of all stanza names in the configuration file.
      name: stanza_name
      type: string
    - default: true
      defaultValue: search
      description: The name of the Splunk application namespace.
      name: app
      type: string
    - defaultValue: nobody
      description: The Access Control List (ACL) owner for the namespace.
      name: owner
      type: string
    - defaultValue: '50'
      description: The maximum number of stanzas to return when stanza_name is omitted. Range 1-500.
      name: limit
      type: number
    description: Lists the stanzas in a .conf file, or returns the key/value content of a single stanza when stanza_name is provided.
    name: splunk-configuration-stanza-list
    outputs:
    - contextPath: Splunk.ConfigurationStanza.StanzaName
      description: The stanza name.
      type: String
    - contextPath: Splunk.ConfigurationStanza.App
      description: The Splunk app namespace the stanza belongs to.
      type: String
    - contextPath: Splunk.ConfigurationStanza.Owner
      description: The Access Control List (ACL) owner of the stanza.
      type: String
    - contextPath: Splunk.ConfigurationStanza.Sharing
      description: The sharing level of the stanza.
      type: String
    - contextPath: Splunk.ConfigurationStanza.Content
      description: The key/value content of the stanza (only returned when a single stanza_name is provided).
      type: Unknown
  - arguments:
    - description: The configuration file name (without the .conf extension).
      name: conf_file
      required: true
      type: string
    - description: The name of the existing stanza to update.
      name: stanza_name
      required: true
      type: string
    - description: 'The JSON object string of attributes to upsert, e.g., {"attribute_1": "A_updated", "new_attr": "X"}. Existing keys are overwritten; missing keys are left untouched (Splunk''s properties endpoint is upsert-only).'
      name: key_value_pairs
      required: true
      type: string
    - default: true
      defaultValue: search
      description: The name of the Splunk application namespace.
      name: app
      type: string
    - defaultValue: nobody
      description: The Access Control List (ACL) owner for the namespace.
      name: owner
      type: string
    description: Updates (upserts) attributes on an existing stanza in a Splunk .conf file.
    name: splunk-configuration-stanza-update
  - arguments:
    - description: The target configuration file name (without the .conf extension).
      name: conf_file
      required: true
      type: string
    - description: The name of the stanza to be removed.
      name: stanza_name
      required: true
      type: string
    - default: true
      defaultValue: search
      description: The name of the Splunk application namespace.
      name: app
      type: string
    - defaultValue: nobody
      description: The Access Control List (ACL) owner for the namespace.
      name: owner
      type: string
    description: |-
      Deletes a stanza (configuration entry) from a Splunk .conf file (for example, transforms.conf) via the Splunk REST API configuration endpoints. This is useful for cleaning up KV Store transformations that remain after deleting KV Store records.
      To identify the correct stanza for deletion, use the splunk-configuration-file-list and splunk-configuration-stanza-list commands. This command is potentially harmful as it irreversibly deletes a stanza from a .conf file.
    name: splunk-configuration-stanza-delete
  - description: Query Splunk to retrieve a list of sample alerts by alert type. Used for mapping fetched incidents through the Get Schema option.
    name: get-mapping-fields
    arguments: []
  - arguments:
    - description: ISO format date with timezone, e.g., 2021-02-09T16:41:30.589575+02:00. The incident is only returned if it was modified after the last update time.
      name: lastUpdate
    description: Gets the list of finding events that were modified since the last update. This command should be used for debugging purposes, and is available from Cortex XSOAR version 6.1.
    name: get-modified-remote-data
  - description: Resets the enrichment mechanism of fetched findings.
    name: splunk-reset-enriching-fetch-mechanism
    arguments: []
  - arguments:
    - default: true
      description: Cortex XSOAR username to match in Splunk's usernames records.
      isArray: true
      name: xsoar_username
      required: true
    description: Returns the Splunk's username matching the given Cortex XSOAR's username.
    name: splunk-get-username-by-xsoar-user
    outputs:
    - contextPath: Splunk.UserMapping.XsoarUser
      description: Cortex XSOAR user mapping.
      type: String
    - contextPath: Splunk.UserMapping.SplunkUser
      description: Splunk user mapping.
      type: String
  - arguments:
    - description: Comma-separated list of job IDs to share.
      isArray: true
      name: sid
      required: true
    - defaultValue: '1800'
      description: Time in seconds for the job's expiry time.
      name: ttl
    description: Change job settings to share its results to all Splunk users, and change its TTL.
    name: splunk-job-share
  - arguments:
    - description: The name of the investigation to be created.
      name: name
      required: true
    - description: The description of the investigation to be created.
      name: description
    - description: The type of the investigation to be created (for example, `default`).
      name: investigation_type
    - auto: PREDEFINED
      description: The status of the investigation to be created. Defaults to the out-of-the-box Splunk ES status labels; custom statuses are also supported by typing the status ID or label.
      name: status
      predefined:
      - New
      - In Progress
      - Pending
      - Resolved
      - Closed
    - auto: PREDEFINED
      description: The disposition of the investigation to be created. Defaults to the out-of-the-box Splunk ES disposition labels; custom dispositions are also supported by typing the disposition ID or label.
      name: disposition
      predefined:
      - Undetermined
      - 'True Positive - Suspicious Activity'
      - 'Benign Positive - Suspicious But Expected'
      - 'False Positive - Incorrect Analytic Logic'
      - 'False Positive - Inaccurate Data'
      - Other
    - description: The Splunk user to assign as the owner of the investigation.
      name: owner
    - auto: PREDEFINED
      description: The urgency of the investigation to be created.
      name: urgency
      predefined:
      - informational
      - low
      - medium
      - high
      - critical
      - unknown
    - auto: PREDEFINED
      description: The sensitivity of the investigation to be created.
      name: sensitivity
      predefined:
      - White
      - Green
      - Amber
      - Red
      - Unassigned
    description: Creates a new investigation in Splunk Enterprise Security.
    execution: true
    name: splunk-investigation-create
    outputs:
    - contextPath: Splunk.Investigation.investigation_guid
      description: The ID (GUID) of the investigation that was created.
      type: String
  - arguments:
    - description: A comma-separated list of investigation IDs (GUID or display ID such as `ES-00001`) to retrieve.
      name: investigation_ids
      isArray: true
    - defaultValue: '20'
      description: The maximum number of investigations to return on the page. Maximum is 100.
      name: limit
    - description: The pagination offset used together with `limit` to specify the starting point of the returned results.
      name: offset
    - description: The sort expression for the returned investigations (for example, `create_time:asc,status:desc`).
      name: sort
    - description: A comma-separated list of disposition IDs or disposition labels to filter investigations by (for example, `disposition:1,Undetermined`).
      name: disposition
      isArray: true
    - description: A comma-separated list of status IDs or status labels to filter investigations by (for example, `New,In progress`).
      name: status
      isArray: true
    - description: A comma-separated list of owners to filter investigations by.
      name: owner
      isArray: true
    - description: A comma-separated list of urgency values to filter investigations by (for example, `medium,high,critical`). Valid values are `informational`, `low`, `medium`, `high`, `critical`, or `unknown`.
      name: urgency
      isArray: true
    - description: A comma-separated list of sensitivity values to filter investigations by (for example, `Amber,Red`). Valid values are `White`, `Green`, `Amber`, `Red`, or `Unassigned`.
      name: sensitivity
      isArray: true
    - description: The minimum (epoch) time during which investigations were created.
      name: create_time_min
    - description: The maximum (epoch) time during which investigations were created.
      name: create_time_max
    - description: The minimum (epoch) time during which investigations were updated.
      name: update_time_min
    - description: The maximum (epoch) time during which investigations were updated.
      name: update_time_max
    description: Lists investigations from Splunk Enterprise Security.
    name: splunk-investigation-list
    outputs:
    - contextPath: Splunk.Investigation.investigation_guid
      description: The ID (GUID) of the investigation.
      type: String
    - contextPath: Splunk.Investigation.investigation_id
      description: The short display ID of the investigation (for example, `ES-00001`).
      type: String
    - contextPath: Splunk.Investigation.name
      description: The name of the investigation.
      type: String
    - contextPath: Splunk.Investigation.description
      description: The description of the investigation.
      type: String
    - contextPath: Splunk.Investigation.investigation_type
      description: The type of the investigation.
      type: String
    - contextPath: Splunk.Investigation.source
      description: The detection that generated the investigation.
      type: String
    - contextPath: Splunk.Investigation.incident_origin
      description: Where the investigation came from (for example, Splunk Enterprise Security or a risk-based alerting finding).
      type: String
    - contextPath: Splunk.Investigation.finding_id
      description: The ID of the originating Splunk Enterprise Security finding.
      type: String
    - contextPath: Splunk.Investigation.disposition
      description: The disposition ID of the investigation.
      type: String
    - contextPath: Splunk.Investigation.disposition_name
      description: The disposition name of the investigation.
      type: String
    - contextPath: Splunk.Investigation.status
      description: The status ID of the investigation.
      type: String
    - contextPath: Splunk.Investigation.status_name
      description: The status name of the investigation.
      type: String
    - contextPath: Splunk.Investigation.owner
      description: The person assigned to the investigation.
      type: String
    - contextPath: Splunk.Investigation.urgency
      description: The urgency of the investigation.
      type: String
    - contextPath: Splunk.Investigation.sensitivity
      description: The sensitivity of the investigation.
      type: String
    - contextPath: Splunk.Investigation.create_time
      description: The time when the investigation was created (epoch seconds).
      type: Number
    - contextPath: Splunk.Investigation.update_time
      description: The time when the investigation was last updated (epoch seconds).
      type: Number
    - contextPath: Splunk.Investigation.mc_create_time
      description: The time when the finding or investigation was created or imported into Splunk Enterprise Security (epoch seconds).
      type: Number
    - contextPath: Splunk.Investigation.count_findings
      description: The number of findings (or intermediate findings) associated with this investigation or finding-based-detection (FBD) group.
      type: Number
    - contextPath: Splunk.Investigation.risk_event_count
      description: The number of risk events associated with this investigation.
      type: Number
    - contextPath: Splunk.Investigation.risk_score
      description: The maximum risk score for all the findings added to the investigation.
      type: Number
    - contextPath: Splunk.Investigation.excluded_finding_ids
      description: A list of finding IDs (or intermediate findings in the finding groups) that are removed from the investigation.
      type: Unknown
    - contextPath: Splunk.Investigation.attachments
      description: An array of file IDs attached directly to the investigation.
      type: Unknown
    - contextPath: Splunk.Investigation.notes
      description: An array of note IDs added directly to the finding or investigation.
      type: Unknown
    - contextPath: Splunk.Investigation.findings.incident_ids
      description: The added finding IDs.
      type: Unknown
    - contextPath: Splunk.Investigation.findings.field_inheritors
      description: The added finding IDs that will inherit this investigation's owner, status, urgency, sensitivity, and disposition values.
      type: Unknown
    - contextPath: Splunk.Investigation.current_response_plan_phase.phase_id
      description: The ID of the current response plan phase.
      type: String
    - contextPath: Splunk.Investigation.current_response_plan_phase.response_plan_id
      description: The ID of the current response plan.
      type: String
    - contextPath: Splunk.Investigation.response_plans
      description: The array of response plans added to the investigation.
      type: Unknown
    - contextPath: Splunk.Investigation.consolidated_findings
      description: The consolidated list of fields for the findings and all the findings that are added to this investigation.
      type: Unknown
    - contextPath: Splunk.Investigation.finding
      description: The raw data of the originating finding.
      type: Unknown
    - contextPath: Splunk.Investigation.custom_fields
      description: The custom fields in the investigation.
      type: Unknown
    - contextPath: Splunk.Investigation.src
      description: A list of values for the `source` field.
      type: Unknown
    - contextPath: Splunk.Investigation.dest
      description: A list of values for the `destination` field.
      type: Unknown
    - contextPath: Splunk.Investigation.dvc
      description: A list of values for the `device` field.
      type: Unknown
    - contextPath: Splunk.Investigation.orig_host
      description: A list of values for the `host` field.
      type: Unknown
    - contextPath: Splunk.Investigation.src_user
      description: A list of values for the `source user` field.
      type: Unknown
    - contextPath: Splunk.Investigation.user
      description: A list of values for the `user` field.
      type: Unknown
    - contextPath: Splunk.Investigation.risk_object
      description: The list of entities for a finding, finding group, or investigation.
      type: Unknown
    - contextPath: Splunk.Investigation.risk_object_type
      description: The list of risk object types for a finding, finding group, or investigation.
      type: Unknown
  dockerimage: demisto/splunksdk-py3:1.0.0.10133006
  isfetch: true
  ismappable: true
  isremotesyncin: true
  isremotesyncout: true
  script: ''
  subtype: python3
  type: python
  runonce: false
tests:
- SplunkPy KV commands
- SplunkPy parse-raw - Test
- SplunkPy-Test-V2
fromversion: 6.0.0