All Apps and Add-ons

Is it possible to set up the SA-SPLICE app MongDB connection to point directly to the SoltraEdge MongoDB?

Ovi
Path Finder

I am wondering if it would be possible to just set up the SPLICE app MongoDB connection to point directly to the SoltraEdge MongoDB? Basically let Soltra do all the TAXII work and have Splunk query directly the Soltra DB and avoid having to set up and maintain a separate MongoDB instance.
Would that be possible/advisable or it will not work and why?
Thanks

Tags (2)
0 Karma
1 Solution

cleroux_splunk
Splunk Employee
Splunk Employee

Short answer, no.

Soltra Edge has its own schema and Splice do not know anything about it. That's exactly why protocol such as TAXII have been developed. What you can do is having your Soltra Edge collecting one or multiple TAXII feeds and then Splice or Splunk Enterprise Security will collect the aggregated results through TAXII.

Enterprise Security leverage the KV Store to store IOCs so you don't have to maintain a separate mongo instance (and they are no plans for Splice to migrate to the KV Store at the moment).

View solution in original post

cleroux_splunk
Splunk Employee
Splunk Employee

Short answer, no.

Soltra Edge has its own schema and Splice do not know anything about it. That's exactly why protocol such as TAXII have been developed. What you can do is having your Soltra Edge collecting one or multiple TAXII feeds and then Splice or Splunk Enterprise Security will collect the aggregated results through TAXII.

Enterprise Security leverage the KV Store to store IOCs so you don't have to maintain a separate mongo instance (and they are no plans for Splice to migrate to the KV Store at the moment).

Ovi
Path Finder

Thanks Cedric. It makes sense.
I just wanted to confirm my understanding before putting forward the solution design

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...