Integrating splunk with XSOAR.

[DP696]

Hi,

Can someone help me with the below queries?

We are in process of integrating splunk with XSOAR.
It’s a cloud service and can be accessed via SplunkCloud and SplunkEnterpriseSecuritySuite.

It should be integrated via SplunkCloud or SplunkEnterpriseSecuritySuite?
What changes/configuration is needed at Splunk end to enable the integration.

Thanks in advance

[chrking]

My understanding is that Splunk Cloud is the base installation (SaaS version) and Enterprise Security is an app that sits on top of the base installation.

The Splunk integration is by default configured to fetch "notable" events which are a kind of event that is defined by the ES app, but the actual API that does the query used for fetching is a feature of the base Splunk and not ES.

The Splunk integration has a lot of additional features (KV lookups, Mirroring, enrichment) that you can find described here: https://xsoar.pan.dev/docs/reference/integrations/splunk-py#splunk-enterprise-security-users but for basic incident fetching all you need is the ability to execute queries against your Splunk cloud.