SOC Prime CCM App for Splunk

With SOC Prime CCM App for Splunk, you can continuously stream new rules and rule updates from the SOC Prime Platform to your cloud or on-prem Splunk instance. This listing includes the deprecated versions of the App up to v2.0.0. Later versions can be found here: https://splunkbase.splunk.com/app/6752. To enable rule streaming, configure Jobs in the Continuous Content Management (CCM) module of the SOC Prime Platform and specify them in the App's data input. Jobs are configured with Content Lists to select rules for deployment, Presets to automatically modify the rules' parameters, and Filters to include additional conditions. You can also set up and apply Custom Field Mapping profiles to make the names of indexes, fields, and even field values in the rule code match your custom data schema. To obtain rules via the CCM module and stream them into your environment, you need access to the SOC Prime CCM API. For more details on the API, see our Platform Guides: https://help.socprime.com/en/articles/6265791-api (to open the Guides, you need to be logged in to your SOC Prime Platform account).