topic Re: Splunk ES availability ticket management in Splunk Enterprise Security

Does Splunk ES have ticket management availability?

hariskhan — Fri, 05 Aug 2022 14:24:44 GMT

Dear Splunkers,

Does splunk ES( when purchased) comes with any build-in ticket management system or one has to buy a new ticketing system for incident management?.
We have Manageengine ticket system deployed in over environment however we are not much sure whether it will fully integrate with splunk or we would have to hire a developer for its integration.

Re: Splunk ES availability ticket management

woodcock — Sun, 11 Aug 2019 20:31:00 GMT

ES does have a basic ticketing system built-in. As many as not use some other more fully-featured ticketing system like ServiceNow or JIRA. We have done many integrations for clients to have Splunk/ES create tickets in 3rd-party systems. There are apps that help, too.

Re: Splunk ES availability ticket management

hariskhan — Tue, 13 Aug 2019 05:00:34 GMT

Thanks woodcock,

Re: Splunk ES availability ticket management

BJ — Mon, 22 Jun 2020 20:50:16 GMT

Do you have the documentation that helps explain what features and functions the internal ticket management systems has? Also how much can be changed like escalations, notifications, attached files, etc.

Re: Splunk ES availability ticket management

jgab1981 — Fri, 18 Dec 2020 17:30:59 GMT

Hi.

Could you provide more information or links about this feature,, in-built ticketing system..

Regards

Re: Splunk ES availability ticket management

lkutch_splunk — Mon, 21 Dec 2020 17:39:56 GMT

You could use the investigation workbench. It's like ticket tracking & collaborating on investigations for assets, identities, or artifacts involved in a potential security incident:
https://docs.splunk.com/Documentation/ES/6.4.0/User/InvestigationWorkbench

Re: Splunk ES availability ticket management

Isaa — Fri, 05 Aug 2022 11:34:36 GMT

Is serviceNow free or paid?