Resilient Integration for Splunk
Overview
Details
IRP, the platform generates a detailed, incident-specific response plan that enables security team members to quickly respond.
Additionally, security team members can add artifacts and other incident details to incident records, and can leverage built-in threat intelligence to gather valuable context needed to inform an intelligent and decisive response.
Resilient Integration for Splunk
Documentation: User Guide
Resilient Web Page: www.resilientsystems.com
Features
-
Easy Incident Mapping: The alert-action UI enables mapping static values or search result tokens into the Resilient incident fields. Fields parsed from the event in the alert can be mapped directly into any incident field. You also get custom incident mapping rules for each saved alert.
-
Create Artifacts: Result tokens can also be mapped into artifacts at the same time the incident mapping is defined.
-
Custom Field Discovery: The app retrieves the incident definition from the Resilient instance so that all defined fields and field values are catalogued inside Splunk. This means you can add custom fields to Resilient platform and they will then be available for mapping in the alert action UI. Just click “save” on the Resilient setup screen to trigger the update.
System Requirements
-
Splunk version 6.6 or later
-
Resilient instance version 27 or later
-
Ability to connect directly from Splunk to your Resilient server with HTTPS on port 443
Browser Compatibility
The Resilient Alert Add-on has been confirmed to work with latest version of major broswers. Some older versions may not properly render the drop-down fields on the alert configuration screen.
Support
For additional support, contact support@resilientsystems.com. Including relevant information from the log files will help us resolve your issue.
Third Party Licenses
Release Notes
Version 25.0.5
Use splunk.rest.simpleRequest for splunkd communication.
Version 25.0.4
Fixed a bug for handling Alert owner. When a user is assigned to an alert as the owner, the Display Name of this user contains both the user name and the user email. When this is mapped to the owner of a Resilient incident, we need to extract the user email.
Enabled HTTPS certificate verification for Splunk Cloud support.