Data Ingestion using the Splunk Enterprise App for Splunk SOAR

The Splunk App for Splunk SOAR pulls event data from Splunk Enterprise. Artifacts pulled in from Splunk Enterprise have all the Carbon Black Cloud alert data packed into a single value without the necessary mappings. You must establish the mappings post-installation .

This method of data ingestion supports alerts and SOAR Actions.

Prerequisites

Get the Splunk App for Splunk SOAR

Procedure

1. Open the Splunk SOAR console.
2. In the left navigation bar, click Apps.
3. On the New Apps menu, locate Splunk and click Install.
4. Go to Unconfigured Apps and confirm that Splunk is present in the section.
5. For configuration instructions, see the README in the project documentation.
   Note:

   • Configure the Command for query to use with On Poll setting to search.
   • Configure the Query to use with On Poll setting needs to index="*carbonblackcloud". Replace carbonblackcloud if non-default index is configured in Splunk Enterprise to store Carbon Black Cloud events.
   • If you are using Splunk Enterprise App version 2.11.0+, use token authentication rather than password authentication for increased security. Follow the steps in Splunk Documentation to generate an API token.

What to do next

Normalize Artifact Playbook