Splunk Enterprise Event Ingestion for Security Operations
Create security response incidents automatically from Splunk Enterprise Events and Alerts.
Install Trend
View Install Data
| Date | Install Count | Change |
|---|---|---|
| 2026-09-09 | 0 | - |
| 134 days of no change | ||
| 2026-04-27 | 107 | -107 |
| 144 days of no change | ||
| 2025-12-03 | 106 | +1 |
| 20 days of no change | ||
| 2025-11-12 | 105 | +1 |
| 21 days of no change | ||
| 2025-10-21 | 104 | +1 |
| 22 days of no change | ||
| 2025-09-28 | 103 | +1 |
| 18 days of no change | ||
| 2025-09-09 | 102 | +1 |
| 33 days of no change | ||
| 2025-08-06 | 101 | +1 |
| 16 days of no change | ||
| 2025-07-20 | 100 | +1 |
| 2 days of no change | ||
| 2025-07-17 | 99 | +1 |
| 23 days of no change | ||
| 2025-06-23 | 97 | +2 |
| 47 days of no change | ||
| 2025-05-06 | 96 | +1 |
| 11 days of no change | ||
| 2025-04-24 | 95 | +1 |
| 87 days of no change | ||
| 2025-01-26 | 94 | +1 |
| 87 days of no change | ||
| 2024-10-30 | 91 | +3 |
About
The Splunk Enterprise Event Ingestion Integration for Security Operations allows security operations center (SOC) analysts to automatically generate Now Platform® Security Incident Response (SIR) incidents when certain configured Splunk Enterprise alerts are triggered. Analysts can also manually forward selected events on-demand from the Splunk console. Analysts respond to the security incidents created with workflows in the Now Platform that automate incident response activities and remediation.
Key Features
This integration includes the following key features:
- Create multiple alert ingestion profiles to create SIR security incidents for specific threats such as phishing and malware.
- Create multiple event profiles for on-demand event forwarding from your Splunk console to create SIR security incidents
- Drag-and-drop the mapping of Splunk alert and event field values to the associated SIR security incident fields.
- A preview of the SIR security incident layout based on sample alerts or events to validate profile configuration.
- Ingest historical alerts and ongoing and future alerts on configurable intervals.
- Aggregate events or alerts to existing SIR security incidents based on matching field values to avoid duplicate security incidents.