integrate with splunk

[alirezakatani]

hello. is your application have ability to integrate with splunk or not?

[Jovonni]

Hey long time @alirezakatani , thank you for the suggestion 🚀

Now that we released v0.0.2, we will add this to the backlog, and work towards it. We will explore:

• making splunk a provider
• exporting anomalies/cases/alerts to splunk

Let us know if you had anything else in mind here

[Ghussy]

@Jovonni I'm needing splunk integration aswell. I'm wanting to get started working on it, but could use some help getting pointed in the right direction.

[Jovonni]

@Ghussy @alirezakatani

Okay great, we will work on this for you guys 🚀

Give me a little detail, are you looking to push/ export anomalies to splunk, or import data from splunk, or both?

This could be useful for several reasons! Let us know

[Ghussy]

@Jovonni My main goal is to export data out of splunk, and create risk profiles on users. Trying to do threat detection essentially. I'm very new to splunk but it seems to have a normalization model layer called CIM. Not sure if that's helpful at all, but it would allow me to use a lot of existing rules I think.

[Jovonni]

Yes — Splunk integration is up in #145. It works both ways: you can run a Splunk search (SPL) as a data source for any model, and optionally forward detected anomalies back into Splunk via HEC. Configurable under Settings → Integrations → Splunk (REST for search, HEC for output), with a connectivity test. Docs in docs/SPLUNK.md.