Splunk

This app integrates with Splunk to update data on the device, in addition to investigate and ingestion actionsBuilt by Splunk LLC

Default Version 2.3.3

September 17, 2021

Compatibility

SOAR On-Prem, SOAR Cloud

Platform Version: 5.5, 5.4, 5.3, 5.2, 5.1, 5.0, 4.10, 4.9

Rating

(0)

Support

Splunk Supported

Ranking

#4 in SIEM

This app integrates with Splunk to update data on the device, in addition to investigate and ingestion actions

Supported actions

test connectivity: Validate the asset configuration for connectivity. This action logs into the device to check the connection and credentials
get host events: Get events pertaining to a host that have occurred in the last 'N' days
on poll: Ingest logs from the Splunk instance
run query: Run a search query on the Splunk device. Please escape any quotes that are part of the query string
update event: Update a notable event
post data: Post data to Splunk