Skip to content

Splunk#

README

Splunk Enterprise Security Notable Status Sync#

SplunkES_NotableStatusSync mirrors a TheHive case/alert stage onto the matching Splunk Enterprise Security notable event(s), via Splunk ES's notable_update REST endpoint. It runs on thehive:case / thehive:alert.

Named after the Splunk-side entity it updates (a notable event), not "alert" — Splunk's native Alert feature is a different thing.

Notable event ID source#

  1. If custom_field_name_notable_event_id is set, the responder reads that custom field. Recommended, and required when running on a case.
  2. Otherwise it falls back to TheHive's native sourceRef, which needs no extra configuration but exists only on alerts, not cases.

Either source may hold one ruleUID (format {UUID}@@notable@@{hash}, as shown in Splunk ES) or a comma-separated list; merged-alert cases producing a list are handled automatically. Each notable event is updated independently, so one stale ruleUID can't block the others — the report lists which succeeded and which failed.

Status mapping#

Splunk ES status IDs are defined per-instance in reviewstatuses.conf, so they are configurable. Defaults match Splunk ES's factory statuses:

TheHive stage Config item Default
New status_id_new 1 (New)
InProgress status_id_in_progress 2 (In Progress)
Imported status_id_in_progress 2 (In Progress)
Closed status_id_closed 5 (Closed)

If your instance customized reviewstatuses.conf, check Enterprise Security > Configure > Incident Management > Incident Review Settings for the IDs in use.

Audit trail and ownership#

Every update sends an auto-generated comment (object type, title, new stage, triggering user) so the status change is recorded.

Enabling sync_owner also sets the notable's newOwner to the case/alert assignee. Off by default — TheHive logins and Splunk usernames are separate identity spaces; only enable it once you've confirmed they align.

Setup#

  • Authenticate with either an auth_token (Splunk 7.3+ Bearer token, token auth enabled on the instance) or username/password — one or the other.
  • Whichever identity is used needs the ess_analyst role and edit_notable_events capability.
  • Use the Splunk management port (default 8089), not the web UI port.
  • Populate custom_field_name_notable_event_id's field with the notable event's ruleUID at import time.

SplunkES_NotableStatusSync#

Author: Fabien Bloume, StrangeBee
License: AGPL-V3
Version: 1.0
Supported data types:
- thehive:case
- thehive:alert
Registration required: True
Subscription required: True
Free subscription: False
Third party service: https://www.splunk.com/en_us/products/enterprise-security.html

Description#

Sync TheHive case/alert status back to the corresponding Splunk Enterprise Security notable event(s)

Configuration#

host Splunk search head / Enterprise Security host or IP
Default value if not configured __
Type of the configuration item string
The configuration item can contain multiple values False
Is required True
port Splunk management (REST API) port
Default value if not configured 8089
Type of the configuration item string
The configuration item can contain multiple values False
Is required False
auth_token Splunk authentication token (Bearer). Splunk 7.3+, token auth must be enabled on the instance. The token's roles must grant the ess_analyst role and edit_notable_events capability. Use this or username/password, not both
Default value if not configured __
Type of the configuration item string
The configuration item can contain multiple values False
Is required False
username Splunk username, only if not using an auth token. Must have the ess_analyst role and edit_notable_events capability
Default value if not configured __
Type of the configuration item string
The configuration item can contain multiple values False
Is required False
password Splunk password, only if not using an auth token
Default value if not configured __
Type of the configuration item string
The configuration item can contain multiple values False
Is required False
verify_ssl Verify the Splunk management port's TLS certificate. Disable only for self-signed/lab instances
Default value if not configured True
Type of the configuration item boolean
The configuration item can contain multiple values False
Is required False
custom_field_name_notable_event_id Recommended: custom field in TheHive containing the Splunk ES notable event ruleUID(s) (format: {UUID}@@notable@@{hash}), comma separated if more than one. Falls back to the native sourceRef field if left empty (or empty on that particular object), but sourceRef only exists on alerts, not cases - set this if the responder will ever run on a thehive:case.
Default value if not configured splunk-notable-event-id
Type of the configuration item string
The configuration item can contain multiple values False
Is required False
status_id_new Splunk ES status ID to set for the TheHive 'New'/'Imported' stage. Status IDs are defined per-instance in reviewstatuses.conf; default matches Splunk ES's factory 'New' status
Default value if not configured 1
Type of the configuration item string
The configuration item can contain multiple values False
Is required False
status_id_in_progress Splunk ES status ID to set for the TheHive 'InProgress' stage. Default matches Splunk ES's factory 'In Progress' status
Default value if not configured 2
Type of the configuration item string
The configuration item can contain multiple values False
Is required False
status_id_closed Splunk ES status ID to set for the TheHive 'Closed' stage. Default matches Splunk ES's factory 'Closed' status
Default value if not configured 5
Type of the configuration item string
The configuration item can contain multiple values False
Is required False
sync_owner Also set the notable event's owner (newOwner) to the case/alert's TheHive assignee. Off by default: TheHive logins and Splunk usernames are different identity spaces with no guaranteed mapping - only enable this once you've confirmed they line up (e.g. both are email addresses, or your Splunk usernames match TheHive logins).
Default value if not configured False
Type of the configuration item boolean
The configuration item can contain multiple values False
Is required False