All Apps and Add-ons

Is it possible to set up the SA-SPLICE app MongDB connection to point directly to the SoltraEdge MongoDB?

Ovi
Path Finder

I am wondering if it would be possible to just set up the SPLICE app MongoDB connection to point directly to the SoltraEdge MongoDB? Basically let Soltra do all the TAXII work and have Splunk query directly the Soltra DB and avoid having to set up and maintain a separate MongoDB instance.
Would that be possible/advisable or it will not work and why?
Thanks

Tags (2)
0 Karma
1 Solution

cleroux_splunk
Splunk Employee
Splunk Employee

Short answer, no.

Soltra Edge has its own schema and Splice do not know anything about it. That's exactly why protocol such as TAXII have been developed. What you can do is having your Soltra Edge collecting one or multiple TAXII feeds and then Splice or Splunk Enterprise Security will collect the aggregated results through TAXII.

Enterprise Security leverage the KV Store to store IOCs so you don't have to maintain a separate mongo instance (and they are no plans for Splice to migrate to the KV Store at the moment).

View solution in original post

cleroux_splunk
Splunk Employee
Splunk Employee

Short answer, no.

Soltra Edge has its own schema and Splice do not know anything about it. That's exactly why protocol such as TAXII have been developed. What you can do is having your Soltra Edge collecting one or multiple TAXII feeds and then Splice or Splunk Enterprise Security will collect the aggregated results through TAXII.

Enterprise Security leverage the KV Store to store IOCs so you don't have to maintain a separate mongo instance (and they are no plans for Splice to migrate to the KV Store at the moment).

Ovi
Path Finder

Thanks Cedric. It makes sense.
I just wanted to confirm my understanding before putting forward the solution design

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...