Skip to content
Integrations
Skip navigation
Integrations
View as Markdown

Splunk Integration

Connect Splunk to WhisperGraph for IOC enrichment, ad-hoc graph queries, threat intel and attack-surface monitoring — components, commands.

Published Last updated

On this page (2)

Splunk Integration Documentation

Whisper Splunk connects your Splunk environment to WhisperGraph — billions of nodes, tens of billions of edges, and millions of threat intelligence edges across 134 feed sources. Enrich IOCs, run ad-hoc graph queries, populate ES threat intel, and monitor your owned attack surface — all from within Splunk.

Get the add-on: Whisper Security TA on Splunkbase →

The add-on, TA-whisper-graph, covers three workflows: enrich your logs, investigate one indicator interactively, and monitor your owned domains. Its Enterprise Security pieces are opt-in and disabled by default, so Splunk ES is optional.

Read coverage before band. Only known-clean — coverage: known-clean. In coverage, no malicious evidence. licenses the word "clean"; no-data — coverage: no-data. Not in coverage. This is not a verdict — nothing was looked at. means unknown, which is a different thing again; malicious-evidenced — coverage: malicious-evidenced. In coverage, with positive evidence of malice. and ambiguous — coverage: ambiguous. In coverage, and the evidence points both ways. mean there is evidence, whatever the band says. Full contract: Coverage — what we looked at.

Getting started

StepGuide
1. Check requirementsRequirements
2. Install the add-onInstallation
3. Configure your API keyConfiguration
4. Enrich your first eventsSearch Commands

Where to go next

  • Install & Configure — requirements, single-instance, distributed and Splunk Cloud installs, and every add-on setting.
  • Deployment Architecture — where the add-on runs in a distributed deployment: search-head clusters, the deployment server, indexer clusters and forwarders.
  • Using It — the search commands, the enrichment pipeline end to end, and the scheduled inputs that watch your domains, IPs and ASNs.
  • Dashboards — the pre-built investigation, attack-surface, compliance and add-on-health views.
  • Enterprise Security — threat-intel collections, the adaptive response action, CIM field aliases, and how to build your own detections.
  • Reference — every sourcetype, field alias, lookup, collection, macro and saved search the add-on ships, with a status on each row.
  • Troubleshooting — common errors, diagnostic commands, log locations and where to get support.
  • Changelog — what shipped in the version you can install.

Writing the queries themselves is covered by the Cypher reference, and worked investigations by Workflows.