Integrating splunk with XSOAR.

DP696 — Fri, 17 Mar 2023 10:34:47 GMT

Hi,

Can someone help me with the below queries?

We are in process of integrating splunk with XSOAR.
It’s a cloud service and can be accessed via SplunkCloud and SplunkEnterpriseSecuritySuite.

It should be integrated via SplunkCloud or SplunkEnterpriseSecuritySuite?
What changes/configuration is needed at Splunk end to enable the integration.

Thanks in advance

Re: Integrating splunk with XSOAR.

chrking — Mon, 20 Mar 2023 00:27:26 GMT

My understanding is that Splunk Cloud is the base installation (SaaS version) and Enterprise Security is an app that sits on top of the base installation.

The Splunk integration is by default configured to fetch "notable" events which are a kind of event that is defined by the ES app, but the actual API that does the query used for fetching is a feature of the base Splunk and not ES.

The Splunk integration has a lot of additional features (KV lookups, Mirroring, enrichment) that you can find described here: https://xsoar.pan.dev/docs/reference/integrations/splunk-py#splunk-enterprise-security-users but for basic incident fetching all you need is the ability to execute queries against your Splunk cloud.

topic Re: Integrating splunk with XSOAR. in Cortex XSOAR Discussions

Integrating splunk with XSOAR.

Re: Integrating splunk with XSOAR.