DO NOT DELETE OR MODIFY THIS APP. This app is used for backend download tests.

Splunk IT Service Intelligence (ITSI) is a monitoring and analytics solution powered by artificial intelligence for IT Operations (AIOps). It provides visibility into the health of critical IT and business services and their infrastructure. Use ITSI to solve a variety of IT challenges, including deriving service-level insights and analysis on events, metrics, and logs to find and fix the most important issues first. Use Splunk ITSI to perform the following tasks: - Aggregate data across your organization to reduce the complexity of tools and IT silos and visually map your key services. - Organize and correlate events cross-functionally and understand their service context for quicker investigations, root cause analysis, and reduced time to incident resolution. - Use machine learning to baseline normal behavior, be alerted of anomalous conditions, and dynamically adapt thresholds in real-time. - Improve your service operations, team productivity, and cross-functional collaboration.

Splunk IT Service Intelligence (ITSI) is a monitoring and analytics solution powered by artificial intelligence for IT Operations (AIOps). It provides visibility into the health of critical IT and business services and their infrastructure. Use ITSI to solve a variety of IT challenges, including deriving service-level insights and analysis on events, metrics, and logs to find and fix the most important issues first. Use Splunk ITSI to perform the following tasks: - Aggregate data across your organization to reduce the complexity of tools and IT silos and visually map your key services. - Organize and correlate events cross-functionally and understand their service context for quicker investigations, root cause analysis, and reduced time to incident resolution. - Use machine learning to baseline normal behavior, be alerted of anomalous conditions, and dynamically adapt thresholds in real-time. - Improve your service operations, team productivity, and cross-functional collaboration.

The Splunk for Microsoft Windows add-on includes predefined inputs to collect data from Windows systems and maps to normalize the data to the Common Information Model.

The Splunk Add-on for Amazon Web Services allows a Splunk® software administrator to collect events, alerts, performance metrics, configuration snapshots, and billing information from the CloudWatch, CloudTrail, and Config services. It can also gather log data from CloudWatch Logs, including VPC Flow Logs, and AWS billing reports and generic log files from S3 buckets. This add-on provides modular inputs and CIM-compatible knowledge to use with other Splunk apps, such as the Splunk App for AWS and Splunk Enterprise Security. Only CloudTrail, CloudWatch, VPC Flow Log, and Config data is tagged for CIM compliance. Because data gathered from S3 buckets is not predictable, the add-on can not normalize it to the CIM data models.

IT Essentials Work helps you correlate logs and metrics for each entity, and then use that information to observe and understand the performance of your infrastructure. The app helps you get started monitoring and analyzing IT infrastructures such as *nix, Windows, virtualization with out-of-the-box dashboards, and pre-configured performance metrics. This app is not yet available for self-service installation on Splunk Cloud. Please contact Splunk Support and submit a Cloud App Request to install IT Essentials Work on your Splunk Cloud deployment. You can find support info at: https://www.splunk.com/en_us/support-and-services/support-programs.html

The Splunk Add-on for Box allows a Splunk Enterprise administrator to collect data from Box and monitor Box events in near real time. The add-on can collect the following data via the Box REST APIs: * enterprise events * metadata about files and folders * user and user group data * collaboration data for folders * tasks data for files After Splunk Enterprise indexes the events, Box administrators can consume the data using the prebuilt dashboard panels included with the add-on. This add-on provides the inputs and CIM-compatible knowledge to use with other Splunk Enterprise apps, such as the Splunk App for Enterprise Security and the Splunk App for PCI Compliance. This add-on must be installed on a Linux instance of Splunk Enterprise for data collection. The add-on is platform independent for indexers and search heads.

Provides backend services for configuring and storing ITSI entities, services, and related objects.

The Splunk App for Chargeback aids customers in understand Splunk Virtual Compute (SVC) usage categorized by business units and departments, utilizing the identical SVC usage data available in the Cloud Monitoring Console (CMC) App within the customer's stack. To access bonus videos from conf23, click on the "Details" tab. IMPORTANT NOTES: 1. The document is now integrated into the app, accessible from the home dashboard. 2. For an optimal experience, consider installing the app independently. Search for "chargeback" among available apps, then click "Install" next to the Splunk App for Chargeback. Refer to the document on the home page for guidance. 3. If you're comfortable reviewing a slightly older document, visit this site: https://docs.splunk.com/Documentation/ChargebackApp/current/Use/Overview Description Splunk App for Chargeback provides an easy-to-use experience to analyze how internal business units are leveraging Splunk. The App provides the framework necessary for Chargeback and/or Showback use cases for: 1. Splunk Virtual Compute (SVC) 2. Dynamic Data: Active Searchable (DDAS) 3. Dynamic Data: Active Archive (DDAA) 4. Dynamic Data: Self-Storage (DDSS) 5. SmartStore The app provide the following functionally to all Splunk customers: - Framework for customers to build their own Chargeback and/or Showback models - Means to determine how many SVCs are allocated to various business units, departments, and users in those departments [Accounting]. - Means to automatically determine how Splunk Cloud stack resources are being used by the various business units [Utilization]. - Ability to drill-down and break down the usage starting at the highest level in the business all the way down to the user level - Ability to forecast SVC usage for the entire organization and by business unit using Splunk Machine Learning - Accurately maintained up-to-date list of identities along with corresponding Business Unit & Department information by way of indexing the data from a source like DB Connect or Active Directory ODS Support You can open an ODS request under task Install/Configure App or TA/Add-On in the support portal (https://www.splunk.com/pdfs/professional-services/splunk-ondemand-services-portal.pdf). Select after choosing Pick your Product = Splunk Core - Enterprise/Splunk Cloud. Enter under the subject/description that you need help configuring the Splunk App for Chargeback specifically. Feedback is always welcome and appreciated.

The visualping app is a convenient tool to monitor websites changes

The Splunk Technology Add-on for Unix and Linux works with the Splunk App for Unix and Linux to provide rapid insights and operational visibility into large-scale Unix and Linux environments. With its new pre-packaged alerting capability, flexible service-based hosts grouping, and easy management of many data sources, it arms administrators with a powerful ability to quickly identify performance and capacity bottlenecks and outliers in Unix and Linux environment.

This is a short introduction for a test app that is for demo purposes only

The Splunk Add-on for CyberArk Enterprise Password Vault (EPV) & Privileged Threat Analytics (PTA) allows a Splunk software administrator to pull system logs and traffic statistics from CyberArk EPV and PTA using syslog.

The Splunk Add-on for Cisco FireSIGHT Management Center (formerly Sourcefire Defense Center) leverages data collected via Cisco eStreamer to allow a Splunk® Enterprise administrator to analyze and correlate IDS log data and malware detection reports from Cisco FireSIGHT and Snort IDS through the Splunk Common Information Model. You can then use the data with other Splunk apps, such as Splunk App for Enterprise Security and Splunk App for PCI Compliance.

This app integrates with CrowdStrike OAuth2 authentication standard to implement querying of endpoint security data

The Splunk Technology Add-on for Unix and Linux works with the Splunk App for Unix and Linux to provide rapid insights and operational visibility into large-scale Unix and Linux environments. With its new pre-packaged alerting capability, flexible service-based hosts grouping, and easy management of many data sources, it arms administrators with a powerful ability to quickly identify performance and capacity bottlenecks and outliers in Unix and Linux environment.

The Splunk Add-on for Cisco ASA allows a Splunk software administrator to map Cisco ASA devices, Cisco PIX, and Cisco FWSM events to the Splunk CIM. You can then use the data with other Splunk apps, such as Splunk Enterprise Security and the Splunk App for PCI Compliance.

The Splunk for Microsoft Windows add-on includes predefined inputs to collect data from Windows systems and maps to normalize the data to the Common Information Model.

The Splunk Add-on for Amazon Web Services allows a Splunk® software administrator to collect events, alerts, performance metrics, configuration snapshots, and billing information from the CloudWatch, CloudTrail, and Config services. It can also gather log data from CloudWatch Logs, including VPC Flow Logs, and AWS billing reports and generic log files from S3 buckets. This add-on provides modular inputs and CIM-compatible knowledge to use with other Splunk apps, such as the Splunk App for AWS and Splunk Enterprise Security. Only CloudTrail, CloudWatch, VPC Flow Log, and Config data is tagged for CIM compliance. Because data gathered from S3 buckets is not predictable, the add-on can not normalize it to the CIM data models.

Cloud Connect enables licensed CMP Splunk deployments to connect with select Splunk Cloud Platform and Security features in commercial AWS regions.

The Splunk ES Content Update (ESCU) app delivers pre-packaged Security Content. ESCU provides regular Security Content updates to help security practitioners address ongoing time-sensitive threats, attack methods, and other security issues. Security Content consists of tactics, techniques, and methodologies that help with detection, investigation, and response. Security Content enables security teams to directly operationalize detection searches, investigative searches, and other supporting details. ESCU can generate Notable/Risk Events in Splunk Enterprise Security. Security Content also contains easy-to-read background information and guidance, for key context on motivations and risks associated with attack techniques, as well as pragmatic advice on how to combat those techniques. The analytic stories and their searches are also available at - https://github.com/splunk/security_content.

Splunk DB Connect v2 is a new release of our popular DB Connect add-on. It can help you quickly integrate structured data sources with your Splunk real-time machine data collection. Supports DB2, Informix, MemSQL, Microsoft SQL Server, MySQL, Oracle, PostgreSQL, SAP SQL Anywhere, Sybase ASE, Sybase IQ, and Teradata. Use Splunk DB Connect's Inputs to import structured data for powerful indexing, analysis, and visualization. Use Outputs to export machine data insights to a legacy database to increase your organization's insight. Use Lookups to add meaningful information to your event data by referencing fields in an external database. DB Connect v2 is not compatible with DB Connect v1 at this time.

The Splunk Add-on for Cisco WSA allows a Splunk® software administrator to collect Cisco Web Security Appliance (WSA) access and L4TM log data. You can analyze these logs directly or use them as a contextual data source to correlate with other communication and authentication data in the Splunk platform. This add-on provides the inputs and CIM-compatible knowledge to use with other Splunk apps, such as Splunk Enterprise Security and the Splunk App for PCI Compliance.

The Splunk Add-on for Microsoft Hyper-V allows a Splunk® Enterprise administrator to collect inventory, performance, and alert information from Microsoft Hyper-V environments. You can then directly analyze the data or use it as a contextual data feed to correlate with other data in Splunk Enterprise. This add-on provides the inputs and CIM-compatible knowledge to use with other Splunk Enterprise apps, such as the Splunk App for Enterprise Security and the Splunk App for PCI Compliance. This add-on must be installed on a Windows instance of Splunk Enterprise for data collection. The add-on is platform independent for indexers and search heads.

The Splunk Add-on for McAfee Web Gateway allows a Splunk software administrator to collect logs from McAfee Web Gateway appliance using syslog. This add-on provides the CIM-compatible knowledge to use with other Splunk apps, such as Splunk Enterprise Security and the Splunk App for PCI Compliance.

The Common Information Model is a set of field names and tags which are expected to define the least common denominator of a domain of interest. It is implemented as documentation on the Splunk docs website and JSON data model files in this add-on. Use the CIM add-on when modeling data or building apps to ensure compatibility between apps, or to just take advantage of these data models to pivot and report.

This app implements investigative actions to get information from the Censys search engine

This app integrates with AWS Lambda to perform lambda functions

This app integrates with ServiceNow to perform investigative and generic actions

This app integrates with AWS Simple Systems Manager (SSM) to remotely and securely manage the configuration of any EC2 instance or on-premise machine configured for SSM

This app integrates with AWS Inspector to perform security assessment actions

The Splunk Technology Add-on for Unix and Linux works with the Splunk App for Unix and Linux to provide rapid insights and operational visibility into large-scale Unix and Linux environments. With its new pre-packaged alerting capability, flexible service-based hosts grouping, and easy management of many data sources, it arms administrators with a powerful ability to quickly identify performance and capacity bottlenecks and outliers in Unix and Linux environment.

The Splunk App for Unix and Linux provides rapid insights and operational visibility into large-scale Unix and Linux environments. With its new pre-packaged alerting capability, flexible service-based hosts grouping, and easy management of many data sources, it arms administrators with a powerful ability to quickly identify performance and capacity bottlenecks and outliers in Unix and Linux environment. The Splunk App for Unix and Linux is easy to deploy and comes with configurable data inputs allowing you to quickly provision new Unix and Linux hosts and services. The Splunk App for Unix and Linux is compatible with Splunk 5.x and 6.x. The Splunk App for Unix and Linux is not supported on any version of Internet Explorer because it makes heavy use of scalable vector graphics (SVG), a standard for which IE has limited support. It can, however, be used on any other Splunk-supported browser.

The Splunk for Microsoft Windows add-on includes predefined inputs to collect data from Windows systems and maps to normalize the data to the Common Information Model.

Currently there is no way for Splunk Support to add health checks to a customer's monitoring console. Instead the customer would reach out to Splunk Support, Splunk Support then decides to create new health checks, put them in the new release/patch build, and let the customer know. Problem here is that the turnaround time is too long for the customer, sometimes taking months to wait for the new release, if the requested health checks are added at all, and is a truly painful experience. Hence, we want to decouple new health check items from new releases and give customers the ability to get new health checks themselves without going through Splunk Support.

The Splunk App for Microsoft Windows ONLY works on Splunk 5.x systems. For similar functionality on Splunk 6 and later editions, please use the Splunk App for Windows Infrastructure: http://apps.splunk.com/app/1680/ The Splunk App for Windows provides examples of pre-built data inputs, searches, reports, alerts, and dashboards for Windows server and desktop management. You can monitor, manage, and troubleshoot Windows operating systems from one place. Included are scripted inputs for CPU, disk, I/O, memory, log, configuration, and user data, plus a web-based setup UI for indexing Windows Events Logs.

This app allows you to read data in Splunk buckets using 3rd-party Hadoop-based applications. When you use the Hunk archiving functionality to export your raw-data journal files to HDFS, you can immediately query and analyze that data via Hunk. But what if you want to also view that data via applications like Hive or Pig? This app provides Hadoop tool classes that allow you to do just that: * Provides classes that implement both the “old-style” and new “new-style” Hadoop interfaces, based on the org.apache.hadoop.mapred and org.apache.hadoop.mapreduce packages. * Provides access to index-time fields only — search-time fields are not available. * Lets you configure which fields are retrieved as keys and as values. * Formats returned data as TSV. After installing this app, open it in Hunk. The documentation tab will provide complete usage instructions, including examples.

The Splunk 6.x Dashboard app delivers examples that give you a hands-on way to learn the basic concepts and tools needed to rapidly create rich dashboards using Simple XML. This new app incorporates learn-by-doing Simple XML examples, including extensions to Simple XML for further customization of layout, interactivity, and visualizations. With the app you will learn basic Simple XML concepts and how to incorporate the built-in components. All the included examples deliver a recipe for implementing dashboard elements, beginning with the most basic and progressing to more advanced elements. Each example in the app includes an actual runtime visualization followed by a description and supporting source code.

The Splunk App for Windows Infrastructure provides examples of pre-built data inputs, searches, reports, and dashboards for Windows server and desktop management. You can monitor, manage, and troubleshoot Windows operating systems, including Active Directory elements, all from one place. Included are inputs for performance metrics, event logs, user and audit data. The app makes getting started with Splunk a breeze. The App also contains dashboards needed to monitor your Active Directory environment and allows for correlation opportunities from the Active Directory data back to the Operating System. A unique first-time run experience detects data you might already have to highlight areas for your specific environment. Host Monitoring, Print Monitoring, and Network Monitoring also light up new possibilities.

The Splunk Add-on for Microsoft Active Directory provides the necessary Active Directory knowledge objects for a Splunk App for Microsoft Exchange or Splunk App for Windows Infrastructure deployment. The add-on helps you better understand and get the most out of your Windows Server Active Directory or Microsoft Exchange environment. Download the add-on to integrate into your Splunk App for Microsoft Exchange or Windows Infrastructure deployment or use it to provide Active Directory data to your own Splunk app.

Splunk on Splunk (S.o.S) is an app that turns Splunk's diagnostic tools inward to analyze and troubleshoot problems in your Splunk environment. It contains views and tools that allow you to do the following: * View, search and compare Splunk configuration files. * Detect and expose errors and anomalies in your installation, including inspection of crash logs. * Measure indexing performance and expose event processing bottlenecks. * View details of scheduler and user-driven search activity. * Analyze data volume metrics captured by Splunk. The SoS app has been developed primarily by the Splunk Support team, with the help of Splunk Dev, Splunk Docs, and Sideview LLC (http://sideviewapps.com).

Real-time integration between Splunk Enterprise and relational databases--now with improved access control and support for IBM DB2 and SAP Sybase. Splunk DB Connect delivers reliable, scalable, real-time integration between Splunk Enterprise and relational databases. Integrate structured data from relational databases with data in Splunk Enterprise to drive deeper levels of analysis and operational intelligence. **DB Connect 1.2.1 is compatible with Java 7 or 8.** **DB Connect 1.1.7 or lower is compatible with Java 6 or 7.**

The Splunk App for VMware provides deep operational visibility into granular performance metrics, logs, tasks and events and topology from hosts, virtual machines and virtual centers. It empowers administrators with an accurate real-time picture of the health of the environment, proactively identifying performance and capacity bottlenecks. The latest release of the Splunk App for VMware provides enhanced visibility into the storage tier including built-in correlation and direct drill-downs into NetApp Data ONTAP storage systems. The results are holistic visibility, comprehensive analytics and faster problem resolution. THE SPLUNK APP FOR VMWARE IS AVAILABLE FOR A 60-DAY FREE TRIAL. If you wish to use the Splunk App for VMware beyond the trial, please contact your Splunk sales person. The Splunk App for VMware is compatible with Splunk 6.2.0 and above and VMware vSphere versions 4.1, 5.0, 5.0 Update 1, 5.1, 5.5, and 6.0. Easy Install Video Guide - https://www.youtube.com/watch?v=GgJUkh0eFH4

The Splunk Deployment Monitor App offers insight into your Splunk Deployment

*** THIS APP IS OFFICIALLY DEPRECATED *** As of Splunk 5.0, PDF generation is officially supported in the base platform, making this app no longer necessary for most PDF cases. The PDF Report Server add-on enables your Linux-based Splunk instance to generate emailed reports in PDF format. IMPORTANT: it is only compatible with Intel-based Linux systems and requires the Xvfb and xauth operating system packages to be installed. See the documentation for further details. Instances of Splunk running on non-Linux OS's (Solaris, Windows, etc.) cannot run the PDF Report Server, but they can be configured to use a remote Linux-based Splunk server with this add-on installed to generate PDFs. This add-on requires an Enterprise license and will not work with a Free license. For more information, see: http://www.splunk.com/base/Documentation/4.1/Installation/ConfigurePDFprintingforSplunkWeb

The Splunk Add-on for Cisco ASA allows a Splunk software administrator to map Cisco ASA devices, Cisco PIX, and Cisco FWSM events to the Splunk CIM. You can then use the data with other Splunk apps, such as Splunk Enterprise Security and the Splunk App for PCI Compliance.

The Splunk App for Microsoft Windows Active Directory ONLY works on Splunk 5.x systems. For similar functionality on Splunk 6 and later editions, please use the Splunk App for Windows Infrastructure: http://apps.splunk.com/app/1680/ The Splunk App for Microsoft Windows Active Directory gathers performance metrics, log files, and Powershell data from the domain controllers and DNS servers of a Microsoft Active Directory forest and its underlying infrastructure. It presents the data in a series of operational dashboards covering IT Operations, DNS Debugging, Security and Audit, and Change Management functionalities.

This app integrates with AWS S3 to perform investigative actions

This app integrates with AWS Lambda to perform lambda functions

This App allows for ticket management on Zendesk

This app integrates with the Tenable.io API to provide endpoint-based investigative actions

This is the official app for IP Info used to query the various endpoints of IP Info

This app integrates with ServiceNow to perform investigative and generic actions

This app implements investigative actions to get information from the Censys search engine

This app supports executing investigative and generic type of actions to convert the SOAR vault files to various formats

Phantom app for Verodin

Integrates a variety of ThreatQ services into Phantom.

This app supports investigative actions against a Microsoft Azure SQL Server

This ixia NPB App supports a variety of actions on the network packet broker platform. This App has been tested with Vision One

This app interfaces with the Cisco Meraki cloud managed devices. The search string specified is used to match a value in the client MAC address or description field. The default dashboard URL is dashboard.meraki.com. The API Key is generated in your account profile. An account with read only privileges is acceptable.

This app integrates with AWS Simple Systems Manager (SSM) to remotely and securely manage the configuration of any EC2 instance or on-premise machine configured for SSM

This app integrates with AWS Security Token Service and allows a user to retrieve a temporary set of credentials for some specified account

This app integrates with AWS Elastic Compute Cloud (EC2) to perform virtualization actions