RansomLeak Add-on

RansomLeak is a security-awareness platform: phishing simulations, training assignments, and a per-user human risk score. This add-on brings that data into Splunk over the RansomLeak REST API. FIVE MODULAR INPUTS, each enabled and scheduled independently, so you index only what you need: - Phishing Events (ransomleak:phishing) - simulation outcomes: opens, clicks, attachment opens, credential submissions, OAuth grants and user reports. - Audit Events (ransomleak:audit) - identity and administrative events: sign-in, MFA, SCIM provisioning, password, role, licence, API-token and tenant-settings changes. - Training State (ransomleak:training) - per-enrollment assignment, due and completion state. - Risk Posture (ransomleak:risk) - human risk score and overdue-assignment counts, optionally faceted by team. - Programme Metrics (ransomleak:metrics) - tenant-level aggregates: training completion rate, phishing click and report rates, assignments by category. CIM: audit events are normalised to the Common Information Model and populate the Authentication and Change data models. ALSO INCLUDED: - Five Dashboard Studio views: Overview, Phishing, Identity, Training and Health. - A custom alert action, Assign RansomLeak training, which assigns an exercise to every user named in a triggering search's results. Assignment is idempotent, so a search firing repeatedly over an overlapping window will not re-assign the same person. Requires a RansomLeak tenant and an API token.