About the Splunk integration

Tip

This application is no longer supported.

From 22 August 2022, use both of the following apps instead:

• EclecticIQ Intelligence Center App (Documentation)

• EclecticIQ Intelligence Center TA (Documentation)

Tip

This document was overhauled for version 2.5.5 of the app. To see an older version of the documentation, go to the EclecticIQ Platform 2.8.0 documentation.

EclecticIQ Platform App for Splunk is an app for Splunk Enterprise.

It enables Splunk Enterprise users to ingest large quantities of threat intelligence by integrating EclecticIQ Platform feeds with Splunk and use this threat intelligence within the Splunk Enterprise.

EclecticIQ Platform App for Splunk ships with:

• Scripts to ingest outgoing feeds and to upload sightings back.

• A default set of dashboards to make it easier for Splunk users to monitor feed data collection.

• A default savedsearches to generate alerts in the app.

• A default set of dashboards to allows Splunk users to monitor matching between Threat Intelligence and logs in Splunk (Alerting workflow).

• Workflow actions to quickly get more details about a sighting in the EclecticIQ platform.

Support

Contact us at splunk@eclecticiq.com to:

• Share your feedback or request any support concerning the app.

• Request further documentation.

• Report bugs or feature requests.