Skip to main content

Splunk

Run queries on Splunk servers.

This content pack runs queries on Splunk servers.

When a query or alert triggers a notable event (incident) in Splunk, the event is stored in an index (table). An XSOAR analyst can fetch the event and its context data all from the XSOAR console.

We strongly recommend you to use the SplunkPy pre-release version, specifically if you experience any issues regarding fetch logic, including (but not limited to) missing incidents.

What does this pack do?

Using the SplunkPy integration, you can fetch Splunk notable events. The events contain details such as:

  • The name of the alert that was triggered.
  • The objects that make up the alert, such as the IP address, hashes, and user names.

Besides fetching notable events, the SplunkPy integration enables you to run drill down searches to retrieve additional data from other tables in Splunk such as:

  • Data about the users (department, role, and geographical location)
  • Data about the assets (such as hostname, IP address, geographical location, and department)

In addition, the integration enables mirroring between Splunk and Cortex XSOAR.

Note:
When mirroring or fetching incidents between Splunk to Cortex XSOAR, you need to map Splunk users to Cortex XSOAR users.

PUBLISHER

Cortex XSOAR

INFO

CertificationRead more
Supported ByCortex XSOAR
CreatedJuly 26, 2020
Last ReleaseMay 18, 2022
WORKS WITH THE FOLLOWING INTEGRATIONS:

DISCLAIMER
Content packs are licensed by the Publisher identified above and subject to the Publisher’s own licensing terms. Palo Alto Networks is not liable for and does not warrant or support any content pack produced by a third-party Publisher, whether or not such packs are designated as “Palo Alto Networks-certified” or otherwise. For more information, see the Marketplace documentation.