topic Non Enterprise Security Splunk users in Cortex XSOAR Discussions

Non Enterprise Security Splunk users

tommy.johansson — Wed, 01 May 2024 20:13:20 GMT

Please share some info on how you are running your setup.

We are currently using the TA-Demisto splunk app to push the alerts to the XSOAR but having issues with excessive incidents in XSOAR being created when we use the |table in our searches and havent been able to figure this out.

Thanks in advance for tips and tricks on this subject.

Re: Non Enterprise Security Splunk users

asawyer — Mon, 08 Jul 2024 22:12:33 GMT

Hi @tommy.johansson – Our recommendation is to use the XSOAR SplunkPy integration, rather than the add-on. Please see the instructions here for how to set up and use the integration for a Splunk non-Enterprise Security environment: https://xsoar.pan.dev/docs/reference/integrations/splunk-py#splunk-non-enterprise-security-users