About the Splunk Enterprise Security Integration
Splunk Enterprise Security is Splunk’s premium SIEM solution and the industry benchmark for security analytics, providing advanced threat detection, investigation, and response capabilities built on Splunk’s data platform for enterprise security operations centers worldwide. Part of Synqly’s SIEM Unified API, the Splunk Enterprise Security integration enables security teams to route normalized security event data from Synqly-connected tools into Splunk’s correlation and detection engine through a standardized connector. Integrate with Splunk Enterprise Security to centralize security telemetry from across your stack into Splunk ES, powering correlation searches, notable events, and investigations.
Integration Use Cases
Get Alert
Retrieves an alert by ID.
Post Events
Writes a batch of `Event` objects to the SIEM configured with the token used for authentication.
Query Alerts
Queries alerts from the SIEM configured with the token used for authentication.
Query Events
Queries events from the SIEM configured with the token used for authentication.
Query Log Providers
Queries available log providers in the source SIEM
