staff_picks

it_operations

security

cisco

cisco_observability

cisco_security

detection_response

email_security

endpoint

identity

network

workload_monitoring

accenture

cloud_first

learn_more_accenture

splunk_built_accenture

detect

enrich

respond

pipeline

auditing_compliance

dora_metrics

monitor

Cloud Connect enables licensed CMP Splunk deployments to connect with select Splunk Cloud Platform and Security features in commercial AWS regions.

Splunk Cloud Connect

The Splunk ES Content Update (ESCU) app delivers pre-packaged Security Content. ESCU provides regular Security Content updates to help security practitioners address ongoing time-sensitive threats, attack methods, and other security issues.

Security Content consists of tactics, techniques, and methodologies that help with detection, investigation, and response. Security Content enables security teams to directly operationalize detection searches, investigative searches, and other supporting details. ESCU can generate Notable/Risk Events in Splunk Enterprise Security. Security Content also contains easy-to-read background information and guidance, for key context on motivations and risks associated with attack techniques, as well as pragmatic advice on how to combat those techniques.

The analytic stories and their searches are also available at - https://github.com/splunk/security_content.

Splunk ES Content Update

Splunk DB Connect v2 is a new release of our popular DB Connect add-on. It can help you quickly integrate structured data sources with your Splunk real-time machine data collection. Supports DB2, Informix, MemSQL, Microsoft SQL Server, MySQL, Oracle, PostgreSQL, SAP SQL Anywhere, Sybase ASE, Sybase IQ, and Teradata.

Use Splunk DB Connect's Inputs to import structured data for powerful indexing, analysis, and visualization. Use Outputs to export machine data insights to a legacy database to increase your organization's insight. Use Lookups to add meaningful information to your event data by referencing fields in an external database.

DB Connect v2 is not compatible with DB Connect v1 at this time.

Splunk DB Connect

The Splunk Add-on for Cisco WSA allows a Splunk® software administrator to collect Cisco Web Security Appliance (WSA) access and L4TM log data. You can analyze these logs directly or use them as a contextual data source to correlate with other communication and authentication data in the Splunk platform. This add-on provides the inputs and CIM-compatible knowledge to use with other Splunk apps, such as Splunk Enterprise Security and the Splunk App for PCI Compliance.

Splunk Add-on for Cisco WSA

The Splunk for Microsoft Windows add-on includes predefined inputs to collect data from Windows systems and maps to normalize the data to the Common Information Model.

Splunk Add-on for Microsoft Windows

The Splunk Add-on for Microsoft Hyper-V allows a Splunk® Enterprise administrator to collect inventory, performance, and alert information from Microsoft Hyper-V environments. You can then directly analyze the data or use it as a contextual data feed to correlate with other data in Splunk Enterprise. This add-on provides the inputs and CIM-compatible knowledge to use with other Splunk Enterprise apps, such as the Splunk App for Enterprise Security and the Splunk App for PCI Compliance.

This add-on must be installed on a Windows instance of Splunk Enterprise for data collection. The add-on is platform independent for indexers and search heads.

Splunk Add-on for Microsoft Hyper-V

The Splunk Add-on for McAfee Web Gateway allows a Splunk software administrator to collect logs from McAfee Web Gateway appliance using syslog. This add-on provides the CIM-compatible knowledge to use with other Splunk apps, such as Splunk Enterprise Security and the Splunk App for PCI Compliance.

Splunk Add-on for McAfee Web Gateway

The Common Information Model is a set of field names and tags which are expected to define the least common denominator of a domain of interest. It is implemented as documentation on the Splunk docs website and JSON data model files in this add-on. Use the CIM add-on when modeling data or building apps to ensure compatibility between apps, or to just take advantage of these data models to pivot and report.

Splunk Common Information Model

This app implements investigative actions to get information from the Censys search engine

Censys

This app integrates with AWS Lambda to perform lambda functions

AWS Lambda

This app integrates with ServiceNow to perform investigative and generic actions

ServiceNow

This app integrates with AWS Simple Systems Manager (SSM) to remotely and securely manage the configuration of any EC2 instance or on-premise machine configured for SSM

AWS Systems Manager

This app integrates with AWS Inspector to perform security assessment actions

AWS Inspector

This app integrates with AWS Security Hub to ingest findings

AWS Security Hub

This app integrates with AWS Elastic Compute Cloud (EC2) to perform virtualization actions

AWS EC2

This app integrates with JIRA to perform several ticket management actions

Jira

The Splunk Technology Add-on for Unix and Linux works with the Splunk App for Unix and Linux to provide rapid insights and operational visibility into large-scale Unix and Linux environments.  With its new pre-packaged alerting capability, flexible service-based hosts grouping, and easy management of many data sources, it arms administrators with a powerful ability to quickly identify performance and capacity bottlenecks and outliers in Unix and Linux environment.

Splunk Add-on for Unix and Linux

The Splunk App for Unix and Linux provides rapid insights and operational visibility into large-scale Unix and Linux environments.  With its new pre-packaged alerting capability, flexible service-based hosts grouping, and easy management of many data sources, it arms administrators with a powerful ability to quickly identify performance and capacity bottlenecks and outliers in Unix and Linux environment.

The Splunk App for Unix and Linux is easy to deploy and comes with configurable data inputs allowing you to quickly provision new Unix and Linux hosts and services. 

The Splunk App for Unix and Linux is compatible with Splunk 5.x and 6.x.

The Splunk App for Unix and Linux is not supported on any version of Internet Explorer because it makes heavy use of scalable vector graphics (SVG), a standard for which IE has limited support. It can, however, be used on any other Splunk-supported browser.

Splunk App for Unix and Linux

The Splunk App for Microsoft Windows ONLY works on Splunk 5.x systems. For similar functionality on Splunk 6 and later editions, please use the Splunk App for Windows Infrastructure: http://apps.splunk.com/app/1680/

The Splunk App for Windows provides examples of pre-built data inputs, searches, reports, alerts, and dashboards for Windows server and desktop management. You can monitor, manage, and troubleshoot Windows operating systems from one place. Included are scripted inputs for CPU, disk, I/O, memory, log, configuration, and user data, plus a web-based setup UI for indexing Windows Events Logs.

Splunk 5.x App for Microsoft Windows

This app allows you to read data in Splunk buckets using 3rd-party Hadoop-based applications. When you use the Hunk archiving functionality to export your raw-data journal files to HDFS, you can immediately query and analyze that data via Hunk. 

But what if you want to also view that data via applications like Hive or Pig? This app provides Hadoop tool classes that allow you to do just that:

* Provides classes that implement both the “old-style” and new “new-style” Hadoop interfaces, based on the org.apache.hadoop.mapred and org.apache.hadoop.mapreduce packages.

* Provides access to index-time fields only — search-time fields are not available.

* Lets you configure which fields are retrieved as keys and as values.

* Formats returned data as TSV.

After installing this app, open it in Hunk. The documentation tab will provide complete usage instructions, including examples.

Bucket Reader

Currently there is no way for Splunk Support to add health checks to a customer's monitoring console. Instead the customer would reach out to Splunk Support, Splunk Support then decides to create new health checks, put them in the new release/patch build, and let the customer know. Problem here is that the turnaround time is too long for the customer, sometimes taking months to wait for the new release, if the requested health checks are added at all, and is a truly painful experience. Hence, we want to decouple new health check items from new releases and give customers the ability to get new health checks themselves without going through Splunk Support.

Splunk Health Assistant Add-on

The Splunk 6.x Dashboard app delivers examples that give you a hands-on way to learn the basic concepts and tools needed to rapidly create rich dashboards using Simple XML. This new app incorporates learn-by-doing Simple XML examples, including extensions to Simple XML for further customization of layout, interactivity, and visualizations.

With the app you will learn basic Simple XML concepts and how to incorporate the built-in components. All the included examples deliver a recipe for implementing dashboard elements, beginning with the most basic and progressing to more advanced elements.  Each example in the app includes an actual runtime visualization followed by a description and supporting source code.

Splunk 8.0 Dashboard Examples

The Splunk App for Windows Infrastructure provides examples of pre-built data inputs, searches, reports, and dashboards for Windows server and desktop management. You can monitor, manage, and troubleshoot Windows operating systems, including Active Directory elements, all from one place. 

Included are inputs for performance metrics, event logs, user and audit data. The app makes getting started with Splunk a breeze.  The App also contains dashboards needed to monitor your Active Directory environment and allows for correlation opportunities from the Active Directory data back to the Operating System.  

A unique first-time run experience detects data you might already have to highlight areas for your specific environment. Host Monitoring, Print Monitoring, and Network Monitoring also light up new possibilities.

Splunk App for Windows Infrastructure

The Splunk Add-on for Microsoft Active Directory provides the necessary Active Directory knowledge objects for a Splunk App for Microsoft Exchange or Splunk App for Windows Infrastructure deployment. The add-on helps you better understand and get the most out of your Windows Server Active Directory or Microsoft Exchange environment. Download the add-on to integrate into your Splunk App for Microsoft Exchange or Windows Infrastructure deployment or use it to provide Active Directory data to your own Splunk app.

Splunk Add-on for Microsoft Active Directory

Splunk on Splunk (S.o.S) is an app that turns Splunk's diagnostic tools inward to analyze and troubleshoot problems in your Splunk environment. It contains views and tools that allow you to do the following:  
* View, search and compare Splunk configuration files. 
* Detect and expose errors and anomalies in your installation, including inspection of crash logs. 
* Measure indexing performance and expose event processing bottlenecks. 
* View details of scheduler and user-driven search activity. 
* Analyze data volume metrics captured by Splunk.  
The SoS app has been developed primarily by the Splunk Support team, with the help of Splunk Dev, Splunk Docs, and Sideview LLC (http://sideviewapps.com).

S.o.S - Splunk on Splunk

Real-time integration between Splunk Enterprise and relational databases--now with improved access control and support for IBM DB2 and SAP Sybase.

Splunk DB Connect delivers reliable, scalable, real-time integration between Splunk Enterprise and relational databases. Integrate structured data from relational databases with data in Splunk Enterprise to drive deeper levels of analysis and operational intelligence.

**DB Connect 1.2.1 is compatible with Java 7 or 8.**
**DB Connect 1.1.7 or lower is compatible with Java 6 or 7.**

Splunk DB Connect 1

The Splunk App for VMware provides deep operational visibility into granular performance metrics, logs, tasks and events and topology from hosts, virtual machines and virtual centers. It empowers administrators with an accurate real-time picture of the health of the environment, proactively identifying performance and capacity bottlenecks.

The latest release of the Splunk App for VMware provides enhanced visibility into the storage tier including built-in correlation and direct drill-downs into NetApp Data ONTAP storage systems. The results are holistic visibility, comprehensive analytics and faster problem resolution. 

THE SPLUNK APP FOR VMWARE IS AVAILABLE FOR A 60-DAY FREE TRIAL.  If you wish to use the Splunk App for VMware beyond the trial, please contact your Splunk sales person.

The Splunk App for VMware is compatible with Splunk 6.2.0 and above and VMware vSphere versions 4.1, 5.0, 5.0 Update 1, 5.1, 5.5, and 6.0.

Easy Install Video Guide - https://www.youtube.com/watch?v=GgJUkh0eFH4

Splunk App for VMware

The Splunk Deployment Monitor App offers insight into your Splunk Deployment

Splunk Deployment Monitor

*** THIS APP IS OFFICIALLY DEPRECATED ***

As of Splunk 5.0, PDF generation is officially supported in the base platform, making this app no longer necessary for most PDF cases.

The PDF Report Server add-on enables your Linux-based Splunk instance to generate emailed reports in PDF format. IMPORTANT: it is only compatible with Intel-based Linux systems and requires the Xvfb and xauth operating system packages to be installed. See the documentation for further details. Instances of Splunk running on non-Linux OS's (Solaris, Windows, etc.) cannot run the PDF Report Server, but they can be configured to use a remote Linux-based Splunk server with this add-on installed to generate PDFs. This add-on requires an Enterprise license and will not work with a Free license.  For more information, see: http://www.splunk.com/base/Documentation/4.1/Installation/ConfigurePDFprintingforSplunkWeb

PDF Report Server - install on Linux only

The Splunk Add-on for Cisco ASA allows a Splunk software administrator to map Cisco ASA devices, Cisco PIX, and Cisco FWSM events to the Splunk CIM. You can then use the data with other Splunk apps, such as Splunk Enterprise Security and the Splunk App for PCI Compliance.

Splunk Add-on for Cisco ASA

The Splunk App for Microsoft Windows Active Directory ONLY works on Splunk 5.x systems. For similar functionality on Splunk 6 and later editions, please use the Splunk App for Windows Infrastructure: http://apps.splunk.com/app/1680/

The Splunk App for Microsoft Windows Active Directory gathers performance metrics, log files, and Powershell data from the domain controllers and DNS servers of a Microsoft Active Directory forest and its underlying infrastructure. It presents the data in a series of operational dashboards covering IT Operations, DNS Debugging, Security and Audit, and Change Management functionalities.

Splunk 5.x App for Active Directory

This app integrates with AWS S3 to perform investigative actions

AWS S3

This App allows for ticket management on Zendesk

Zendesk

This is the official app for IP Info used to query the various endpoints of IP Info

IP Info

This app integrates with the Tenable.io API to provide endpoint-based investigative actions

Tenable.io

This ixia NPB App supports a variety of actions on the network packet broker platform. This App has been tested with Vision One

Ixia Network Packet Broker

This app supports investigative actions against a Microsoft Azure SQL Server

Microsoft Azure SQL

This app interfaces with the Cisco Meraki cloud managed devices. The search string specified is used to match a value in the client MAC address or description field. The default dashboard URL is dashboard.meraki.com. The API Key is generated in your account profile. An account with read only privileges is acceptable.

Cisco Meraki Dashboard

Verodin

Integrates a variety of ThreatQ services into Phantom.

ThreatQ

This app supports executing investigative and generic type of actions to convert the SOAR vault files to various formats

Cloud Convert

This app supports hunting and a variety of investigative actions, in addition to report ingestion, from the Accenture DeepSight Intelligence cyber security service

DeepSight

This app integrates with Alibaba Resource Access Management (Alibaba RAM) to support various containment, corrective, and investigate actions

Alibaba RAM

This app integrates with Arbor Networks APS to execute containment and corrective actions

Arbor APS

DO NOT DELETE OR MODIFY THIS APP.

This app is used for backend download tests.

Download Test App

E2E Redirect Test Public App

The Splunk Add-on for Cisco UCS allows a Splunk® Enterprise administrator to collect UCS fault, inventory, and performance data from Cisco UCS servers using the UCS API. After Splunk Enterprise indexes the events, you can analyze the data using the prebuilt dashboard panels included with the add-on. This add-on provides the inputs and CIM-compatible knowledge to use with other Splunk Enterprise apps, such as the Splunk App for Enterprise Security and the Splunk App for PCI Compliance.

Splunk Add-on for Cisco UCS

Splunk Enterprise Security gives teams the insight to quickly detect and respond to internal and external attacks, to simplify threat management while minimizing risk. ES helps teams gain organization-wide visibility and security intelligence for continuous monitoring, incident response, SOC operations, and providing executives a window into business risk.

•	Continuously Monitor: get a clear picture of security posture using pre-defined dashboards, key security and performance indicators, static & dynamic thresholds, and trending indicators
•	Prioritize and Act: optimize incident response workflows with alerts, centralized logs, and pre-defined reports and correlations
•	Conduct Rapid Investigations: use ad-hoc search and static, dynamic and visual correlations to detect malicious activities
•	Handle Multi-step Investigations: trace activities associated with compromised systems and apply the kill-chain methodology to see the attack lifecycle

Splunk ES is a premium security solution requiring a paid license

Splunk Enterprise Security

ITSI SSAI POC

Provides REST API and KV store infrastructure for access control and user role management that other Splunk apps can consume programmatically.

demo-SA-UserAccess

Creates and configures custom summary indexes for ITSI deployments, including indexes for KPI summaries, metrics, notable events, anomaly detection, and infrastructure monitoring data.

demo-SA-IndexCreation

The Splunk Add-on for OSSEC allows a Splunk® software administrator to collect alert events from OSSEC servers over syslog. The add-on collects the following alert data from OSSEC:

* File Integrity Management (FIM) data
* FTP data
* su data
* ssh data
* Windows data, including audit and logon information

At this time, the add-on does not support data collection for OSSEC daemon logs, agent logs, or logs from the active response module.

After the Splunk platform indexes the events, you can consume the data using the prebuilt dashboard panels included with the add-on. This add-on provides the inputs and CIM-compatible knowledge to use with other Splunk apps, such as the Splunk App for Enterprise Security and the Splunk App for PCI Compliance.

Splunk Add-on for OSSEC

Splunk IT Service Intelligence is a monitoring solution that offers an innovative, machine-data driven approach to provide comprehensive visibility into operational health and key performance indicators of IT services and the infrastructure that underpins it.  

Use Splunk IT Service Intelligence to:
Define relevant service relationships to quickly visualize and understand dependencies and potential performance impact
Present real-time insights into service health against defined performance indicators to driven operational and business decisions
Organize and correlate relevant metrics/events into ‘swim lanes’ to speed up investigations and diagnosis
Run pre-defined correlation searches against learned indicators to generate notable events
Pre-program static thresholds and assign weights to define severity levels 
Employ machine learning to baseline normal operational patterns and adapt thresholds to changing behavior in real-time

Get more out of Splunk with applications

Trending Apps on Splunkbase

New Splunk Built and Supported Apps

Splunkbase Collections

Most popular Splunk Cloud Apps

Most popular SOAR Connectors

Not finding the perfect app? Build it!