integrate with splunk

[alirezakatani]

hello. is your application have ability to integrate with splunk or not?

[Jovonni]

Hey long time @alirezakatani , thank you for the suggestion 🚀

Now that we released v0.0.2, we will add this to the backlog, and work towards it. We will explore:

• making splunk a provider
• exporting anomalies/cases/alerts to splunk

Let us know if you had anything else in mind here

[Ghussy]

@Jovonni I'm needing splunk integration aswell. I'm wanting to get started working on it, but could use some help getting pointed in the right direction.

[Jovonni]

@Ghussy @alirezakatani

Okay great, we will work on this for you guys 🚀

Give me a little detail, are you looking to push/ export anomalies to splunk, or import data from splunk, or both?

This could be useful for several reasons! Let us know

[Ghussy]

@Jovonni My main goal is to export data out of splunk, and create risk profiles on users. Trying to do threat detection essentially. I'm very new to splunk but it seems to have a normalization model layer called CIM. Not sure if that's helpful at all, but it would allow me to use a lot of existing rules I think.