TA_Cisodium

The Cisodium Add-on collects security management data from a Cisodium information security management platform via HTTPS API. The add-on retrieves incidents, vulnerabilities, risks, assets, security controls, and audit logs from a configured Cisodium tenant and indexes them in Splunk as JSON events. Each event represents a record's full state at the time of collection, capturing create, change, and deletion operations to maintain both current and historical views of the security posture. The add-on maps collected data to five Common Information Model domains: Ticket Management for incidents, Vulnerabilities for vulnerability records, Inventory for asset data, Authentication for audit logs, and Change for control and risk modifications. Field extractions and CIM-compliant mappings enable the data to integrate with Splunk Enterprise Security and other analytics applications. The add-on includes a workflow action that allows analysts to open a Cisodium record directly from Splunk search results, and provides dashboards for monitoring collection health and configuring inputs.