Splunk#

README

Splunk Enterprise Security Notable Status Sync#

SplunkES_NotableStatusSync mirrors a TheHive case/alert stage onto the matching Splunk Enterprise Security notable event(s), via Splunk ES's notable_update REST endpoint. It runs on thehive:case / thehive:alert.

Named after the Splunk-side entity it updates (a notable event), not "alert" — Splunk's native Alert feature is a different thing.

Notable event ID source#

If custom_field_name_notable_event_id is set, the responder reads that custom field. Recommended, and required when running on a case.
Otherwise it falls back to TheHive's native sourceRef, which needs no extra configuration but exists only on alerts, not cases.

Either source may hold one ruleUID (format {UUID}@@notable@@{hash}, as shown in Splunk ES) or a comma-separated list; merged-alert cases producing a list are handled automatically. Each notable event is updated independently, so one stale ruleUID can't block the others — the report lists which succeeded and which failed.

Status mapping#

Splunk ES status IDs are defined per-instance in reviewstatuses.conf, so they are configurable. Defaults match Splunk ES's factory statuses:

TheHive stage	Config item	Default
New	`status_id_new`	`1` (New)
InProgress	`status_id_in_progress`	`2` (In Progress)
Imported	`status_id_in_progress`	`2` (In Progress)
Closed	`status_id_closed`	`5` (Closed)

If your instance customized reviewstatuses.conf, check Enterprise Security > Configure > Incident Management > Incident Review Settings for the IDs in use.

Audit trail and ownership#

Every update sends an auto-generated comment (object type, title, new stage, triggering user) so the status change is recorded.

Enabling sync_owner also sets the notable's newOwner to the case/alert assignee. Off by default — TheHive logins and Splunk usernames are separate identity spaces; only enable it once you've confirmed they align.

Setup#

Authenticate with either an auth_token (Splunk 7.3+ Bearer token, token auth enabled on the instance) or username/password — one or the other.
Whichever identity is used needs the ess_analyst role and edit_notable_events capability.
Use the Splunk management port (default 8089), not the web UI port.
Populate custom_field_name_notable_event_id's field with the notable event's ruleUID at import time.

SplunkES_NotableStatusSync#

Author: Fabien Bloume, StrangeBee
License: AGPL-V3
Version: 1.0
Supported data types:
- thehive:case
- thehive:alert
Registration required: True
Subscription required: True
Free subscription: False
Third party service: https://www.splunk.com/en_us/products/enterprise-security.html

Description#

Sync TheHive case/alert status back to the corresponding Splunk Enterprise Security notable event(s)

Configuration#

host	Splunk search head / Enterprise Security host or IP
Default value if not configured	__
Type of the configuration item	string
The configuration item can contain multiple values	False
Is required	True

port	Splunk management (REST API) port
Default value if not configured	8089
Type of the configuration item	string
The configuration item can contain multiple values	False
Is required	False

auth_token	Splunk authentication token (Bearer). Splunk 7.3+, token auth must be enabled on the instance. The token's roles must grant the ess_analyst role and edit_notable_events capability. Use this or username/password, not both
Default value if not configured	__
Type of the configuration item	string
The configuration item can contain multiple values	False
Is required	False

username	Splunk username, only if not using an auth token. Must have the ess_analyst role and edit_notable_events capability
Default value if not configured	__
Type of the configuration item	string
The configuration item can contain multiple values	False
Is required	False

password	Splunk password, only if not using an auth token
Default value if not configured	__
Type of the configuration item	string
The configuration item can contain multiple values	False
Is required	False

verify_ssl	Verify the Splunk management port's TLS certificate. Disable only for self-signed/lab instances
Default value if not configured	True
Type of the configuration item	boolean
The configuration item can contain multiple values	False
Is required	False

custom_field_name_notable_event_id	Recommended: custom field in TheHive containing the Splunk ES notable event ruleUID(s) (format: {UUID}@@notable@@{hash}), comma separated if more than one. Falls back to the native sourceRef field if left empty (or empty on that particular object), but sourceRef only exists on alerts, not cases - set this if the responder will ever run on a thehive:case.
Default value if not configured	splunk-notable-event-id
Type of the configuration item	string
The configuration item can contain multiple values	False
Is required	False

status_id_new	Splunk ES status ID to set for the TheHive 'New'/'Imported' stage. Status IDs are defined per-instance in reviewstatuses.conf; default matches Splunk ES's factory 'New' status
Default value if not configured	1
Type of the configuration item	string
The configuration item can contain multiple values	False
Is required	False

status_id_in_progress	Splunk ES status ID to set for the TheHive 'InProgress' stage. Default matches Splunk ES's factory 'In Progress' status
Default value if not configured	2
Type of the configuration item	string
The configuration item can contain multiple values	False
Is required	False

status_id_closed	Splunk ES status ID to set for the TheHive 'Closed' stage. Default matches Splunk ES's factory 'Closed' status
Default value if not configured	5
Type of the configuration item	string
The configuration item can contain multiple values	False
Is required	False

sync_owner	Also set the notable event's owner (newOwner) to the case/alert's TheHive assignee. Off by default: TheHive logins and Splunk usernames are different identity spaces with no guaranteed mapping - only enable this once you've confirmed they line up (e.g. both are email addresses, or your Splunk usernames match TheHive logins).
Default value if not configured	False
Type of the configuration item	boolean
The configuration item can contain multiple values	False
Is required	False