Splunk Cloud Risk Events (ip_address) - Custom Event Ingestion
Details
This workflow searches for events in the Splunk Cloud risk index (alerts) and ingest them in the XDR Data Analytics Platform (detection findings) for incident generation. The default query excludes : - XDR incident event collected by splunk and promoted as notables - threat_object_type not equals ip_address It is designed to run every X minutes (default 5) via schedule rule
Description
Installation and Configuration Instructions
-
Install the Workflow
- Ensure you have the Splunk Cloud integration enabled in XDR.
- Install the workflow from XDR automate Exchange.
- Set the Input variables
-
Automate the Workflow
- When prompted to "Automate it," add a scheduled automation rule or add it later.
- The interval has to match the one configured in the input variable "Workflow Run Interval"
-
Expected behavior
- Workflow transforms each collected logs into a Custom Security Event
- Events are stored as Detection Findings
- Findings automatically participate in:
- Correlation
- Incident generation
-
Verification
- Navigate to Detection Findings Viewer in Cisco XDR
- Confirm that:
- Events are being ingested as Detection Findings
- Detection Findings may be correlated into Incidents
Required targets
This workflow requires the following targets to be available before it can be run.
Integration targets
- Splunk Cloud
- Cisco XDR
About
Author
Ivan Berlinson
Version
v1.1
Intent
Custom Security Event
Integration
Average rating
No ratings yet
Authorship
Community
Contact and support information
External links
Related workflows
Cisco Managed
This incident response workflow allows you to export a summary of an XDR incident to a Splunk Cloud index from a playbook or using an automation rule.
Community
This workflows will run a Search Query for an Observable in Splunk Cloud via the Pivot Menu.
Community
This workflow enhances security management by automating the process of identifying and managing network security events using Splunk and Cisco XDR.
Community
This workflow searches for events in a Splunk Cloud instance and creates a new Cisco XDR incident (via private intelligence) or updates an existing one created by a workflow.
Community
This workflow searches for network detections events in a Splunk Cloud tenant based on a custom search query (see template) and ingest them in the XDR Data Analytics Platform (detection findings) for incident generation.
Cisco Managed
This workflows exports XDR detection findings to Splunk Cloud every 5 minutes using a schedule automation rule.