Splunk Cloud - Export Incident Summary to Index

This incident response workflow allows you to export a summary of an XDR incident to a Splunk Cloud index from a playbook or using an automation rule. When using this workflow in a playbook, the user initiates the export. When using this workflow with an incident automation rule, the export can be done automatically when an incident is created. Sending incidents to Splunk allows them to be indexed for correlation with your other logs and allows for longer data retention than what may be available in Cisco XDR.

Target: Automation APIs, Conure APIs, Platform APIs, Splunk Cloud

Steps:

• Fetch the incident summary (if this fails, end the workflow)
• Process the incident summary
• Check if the workflow was configured with inputs:
  • If not, attempt to get the required configuration data from the Splunk Cloud integration
• Send the incident summary to the Splunk HTTP event collector