#Splunk soar documentation manual#
#Splunk soar documentation full#
#Splunk soar documentation software#

Examples include: artifact, customfunction, playbookinput, and an action block name. The name before the last colon describes the data's location. Datapaths with CEF fields are described in the next section, Datapaths and CEF fields. You can view recommended Mission Experts, Playbooks, and Actions in their respective sections. Datapaths have the same general structure, shown in the figure below and described here. Select Analyst to switch to Analyst view.To view guidance information, complete the following tasks: For example, if there is no recent activity from the user, then they are less of an expert. Perform the following steps to access the Users page: From the Home menu, select Administration. The recency that a user interacts with a container, event, or case. View the Users page to see the users configured on your instance, add new users, or edit existing users.For example, a user who frequently changes the state of containers with the same label is an expert. The frequency that a user interacts with a label.The users working on containers, events, or cases with the same label.Previous playbooks or actions run on containers, events, or cases with the same label.provides the recommendations based on a variety of factors, including the following: Mission experts are the users who have taken action on containers, events, or cases with the same label. Use the Guidance tab to find recommended users, playbooks, and actions for resolving an event. Select creates a card with a dropdown list of options.View recommended playbooks, actions, and mission experts for resolving an event Text creates an input field where you can add a small amount of text.

#Splunk soar documentation manual#

The following table describes the manual card options: Click the gear icon to open the Configure HUD modal.Expand the HUD menu by clicking the downward-facing double chevron icon.From the Home menu, select either Cases or Sources > My Events.Perform the following steps to add a card to the HUD: Manual cards let you add a customized card to the HUD for an event or case. You can add or remove these cards, but only an administrator can change the card options. Preset Metrics and Custom Fields cards are defined by a administrator and display one of the built-in metrics or the information from a custom field. The following HUD card types are available: To be even more efficient, you can create the container and artifacts in a single POST (see above) in which case you should not set runautomation at all, as Splunk SOAR automatically sets runautomation after the last artifact is created. Users can customize the HUD for an event or case by adding or removing cards, or configuring manual cards of their own design. This will cause automation such as active playbooks to run only after all artifacts have been added. administrators control HUD card settings. The collapsible heads up display (HUD) helps you track important metrics and information.

View the status of an event or case and also perform actions, such as running a playbook, adding and editing a workbook, or viewing and adding artifacts. Grow your knowledge and skills in installing and configuring a SOAR server and integrating it with the Splunk platform. To learn what you can do with each view, see the following table: Switch between views by selecting the toggle switch for the Summary or Analyst view in an event or case. You can quickly view information and perform actions using the summary and analyst views in.

#Splunk soar documentation full#

Case management also has full access to the Automation Engine, allowing you to launch actions and playbooks as part of a task. Case management supports tasks that map to your defined Standard Operating Procedures (SOPs). You can use to promote a verified event to a case using the integrated case management capability. The activity feed also provides team collaboration capabilities that are integrated inline with automation details and other data, forming a record of all relevant event information.

It provides a summary of the success, ongoing execution, and results of all automation operations for the event. The activity feed displays current and historical action and playbook activity that has acted on the currently displayed event. The Investigation page provides you access to event activity history, contextual and interactive data views, secure file attachments, and automation and case management controls.

#Splunk soar documentation software#

An event is a single piece of data in Splunk software with a given timestamp, host, source, and source type. Use the Investigation page as the starting point to understand, investigate, and act on events.