darkmoon

Darkmoon Pentest brings your Darkmoon AI penetration-testing results into Splunk and closes the loop back to Darkmoon. A producer — the bundled forwarder or a Darkmoon Pro webhook — sends safe JSON events to the HTTP Event Collector. The app parses them into CIM-aligned sourcetypes (darkmoon:campaign, darkmoon:finding, darkmoon:retest, darkmoon:pr) mapped to the Vulnerabilities data model, so findings sit alongside the rest of your security data. Events carry safe metadata only — campaign and finding ids, severity, status, target reference, MITRE ATT&CK technique, technology and timestamps. Evidence, secrets, credentials, tokens and request/response bodies are never ingested, with index-time redaction as a second line of defense. Six SOC dashboards give analysts an immediate picture: an Overview of KPIs and posture, Findings with full filtering, MITRE ATT&CK and Technology coverage, Campaigns, Remediation and Retest tracking, plus Setup and Help. Every panel drills down from posture to campaign to finding. For Darkmoon Pro users, the "Send to Darkmoon" alert action turns Splunk into an offensive-validation trigger: a correlation search can launch a retest or a new campaign, hard-secured with a target allowlist, a safe-harbor default, a token stored encrypted in storage/passwords, rate limiting, TLS verification and a dry-run default. Ingestion and dashboards work with any Darkmoon edition that can emit events; the alert action and setup use the Darkmoon Pro REST API.