soar
Splunk
Splunk SOAR Cloud
Splunk Built
Overview
This app integrates with Splunk to update data on the device, in addition to investigate and ingestion actions
Supported Actions Version 2.10.0
- test connectivity: Validate the asset configuration for connectivity. This action logs into the device to check the connection and credentials
- get host events: Get events pertaining to a host that have occurred in the last 'N' days
- on poll: Ingest logs from the Splunk instance
- run query: Run a search query on the Splunk device. Please escape any quotes that are part of the query string
- update event: Update a notable event
- post data: Post data to Splunk
Supported Actions Version 2.9.0
- test connectivity: Validate the asset configuration for connectivity. This action logs into the device to check the connection and credentials
- get host events: Get events pertaining to a host that have occurred in the last 'N' days
- on poll: Ingest logs from the Splunk instance
- run query: Run a search query on the Splunk device. Please escape any quotes that are part of the query string
- update event: Update a notable event
- post data: Post data to Splunk
Supported Actions Version 2.8.0
- test connectivity: Validate the asset configuration for connectivity. This action logs into the device to check the connection and credentials
- get host events: Get events pertaining to a host that have occurred in the last 'N' days
- on poll: Ingest logs from the Splunk instance
- run query: Run a search query on the Splunk device. Please escape any quotes that are part of the query string
- update event: Update a notable event
- post data: Post data to Splunk
Supported Actions Version 2.7.0
- test connectivity: Validate the asset configuration for connectivity. This action logs into the device to check the connection and credentials
- get host events: Get events pertaining to a host that have occurred in the last 'N' days
- on poll: Ingest logs from the Splunk instance
- run query: Run a search query on the Splunk device. Please escape any quotes that are part of the query string
- update event: Update a notable event
- post data: Post data to Splunk
Supported Actions Version 2.6.7
- test connectivity: Validate the asset configuration for connectivity. This action logs into the device to check the connection and credentials
- get host events: Get events pertaining to a host that have occurred in the last 'N' days
- on poll: Ingest logs from the Splunk instance
- run query: Run a search query on the Splunk device. Please escape any quotes that are part of the query string
- update event: Update a notable event
- post data: Post data to Splunk
Supported Actions Version 2.6.6
- test connectivity: Validate the asset configuration for connectivity. This action logs into the device to check the connection and credentials
- get host events: Get events pertaining to a host that have occurred in the last 'N' days
- on poll: Ingest logs from the Splunk instance
- run query: Run a search query on the Splunk device. Please escape any quotes that are part of the query string
- update event: Update a notable event
- post data: Post data to Splunk
Supported Actions Version 2.4.8
- test connectivity: Validate the asset configuration for connectivity. This action logs into the device to check the connection and credentials
- get host events: Get events pertaining to a host that have occurred in the last 'N' days
- on poll: Ingest logs from the Splunk instance
- run query: Run a search query on the Splunk device. Please escape any quotes that are part of the query string
- update event: Update a notable event
- post data: Post data to Splunk
Supported Actions Version 2.3.3
- test connectivity: Validate the asset configuration for connectivity. This action logs into the device to check the connection and credentials
- get host events: Get events pertaining to a host that have occurred in the last 'N' days
- on poll: Ingest logs from the Splunk instance
- run query: Run a search query on the Splunk device. Please escape any quotes that are part of the query string
- update event: Update a notable event
- post data: Post data to Splunk
Supported Actions Version 2.2.3
- test connectivity: Validate the asset configuration for connectivity. This action logs into the device to check the connection and credentials
- get host events: Get events pertaining to a host that have occurred in the last 'N' days
- on poll: Ingest logs from the Splunk instance
- run query: Run a search query on the Splunk device. Please escape any quotes that are part of the query string
- update event: Update a notable event
- post data: Post data to Splunk
Supported Actions Version 2.1.6
- test connectivity: Validate the asset configuration for connectivity. This action logs into the device to check the connection and credentials
- get host events: Get events pertaining to a host that have occurred in the last 'N' days
- on poll: Ingest logs from the Splunk instance
- run query: Run a search query on the Splunk device. Please escape any quotes that are part of the query string
- update event: Update a notable event
- post data: Post data to Splunk
Supported Actions Version 2.1.3
- test connectivity: Validate the asset configuration for connectivity. This action logs into the device to check the connection and credentials
- get host events: Get events pertaining to a host that have occurred in the last 'N' days
- on poll: Ingest logs from the Splunk instance
- run query: Run a search query on the Splunk device. Please escape any quotes that are part of the query string
- update event: Update a notable event
- post data: Post data to Splunk
Release Notes
Version 2.10.0
April 27, 2022
- Fixed an issue in On Poll action where the index time was not honored during scheduled ingestion [PAPP-25411]
Version 2.9.0
April 2, 2022
- Added 2 new fields ("start_time" and "end_time") to "run query" action [PAPP-24566]
Version 2.8.0
March 9, 2022
- Added a sleep time between REST calls to improve the performance [PAPP-23575]
Version 2.7.0
Feb. 17, 2022
- Added a new 'attach_result' parameter in 'run query' action [PAPP-8315]
Version 2.6.7
Feb. 7, 2022
- Added support for Python 3.9
Version 2.6.6
Jan. 20, 2022
Splunk Release Notes - Published by Splunk January 20, 2022
Version 2.6.6 - Released January 20, 2022
- Changed the hashing algorithm to SHA256 when running in FIPS mode [PAPP-21816]
Version 2.4.8
Oct. 19, 2021
Splunk Release Notes - Published by Splunk October 19, 2021
Version 2.4.8 - Released October 19, 2021
- Added a new 'Remove CEF fields having empty values from the artifact' configuration parameter [PAPP-9257]
Version 2.3.3
Sept. 21, 2021
Splunk Release Notes - Published by Splunk August 06, 2021
Version 2.3.3 - Released August 06, 2021
- Updated the 'update event' action's status based on the "success" key in response [PAPP-9587]
- Modified the code to re-connect based on retry limit in case of "Session not logged in" issue [PAPP-17690]
- Modified the on-poll action to ingest updated/deleted artifacts in the existing container [PAPP-18788]
- Updated the document for Update event action with the required role and permission
Version 2.2.3
Sept. 21, 2021
Splunk Release Notes - Published by Splunk August 06, 2021
Version 2.2.3 - Released July 13, 2021
- Added support for custom status ID in the integer status parameter of the 'update event' action [PAPP-9598]
- Bug fix in the 'run query' action [PAPP-13769]
- Allow 0 for the 'Max events to ingest for Scheduled Polling' configuration parameter [PAPP-11483]
- Fix for the 'Values to append to the container name' configuration parameter [PAPP-11072] [PAPP-17977]
- Handled extra commas in the display parameter of the 'run query' action [PAPP-17228]
Version 2.1.6
Sept. 21, 2021
Splunk Release Notes - Published by Splunk August 06, 2021
Version 2.1.6 - Released June 24, 2021
- Fixed the start_time field in the artifact [PAPP-17613]
Version 2.1.3
Sept. 21, 2021
Splunk Release Notes - Published by Splunk August 06, 2021
Version 2.1.3 - Released April 14, 2021
- Fixed a bug which caused the app to ignore the Global Proxy Settings [PAPP-11360]
- Fixed a bug during ingestion if an event had multiple associated severities [PAPP-12153]