All Apps and Add-ons

Is it possible to set up the SA-SPLICE app MongDB connection to point directly to the SoltraEdge MongoDB?

Ovi
Path Finder

I am wondering if it would be possible to just set up the SPLICE app MongoDB connection to point directly to the SoltraEdge MongoDB? Basically let Soltra do all the TAXII work and have Splunk query directly the Soltra DB and avoid having to set up and maintain a separate MongoDB instance.
Would that be possible/advisable or it will not work and why?
Thanks

Tags (2)
0 Karma
1 Solution

cleroux_splunk
Splunk Employee
Splunk Employee

Short answer, no.

Soltra Edge has its own schema and Splice do not know anything about it. That's exactly why protocol such as TAXII have been developed. What you can do is having your Soltra Edge collecting one or multiple TAXII feeds and then Splice or Splunk Enterprise Security will collect the aggregated results through TAXII.

Enterprise Security leverage the KV Store to store IOCs so you don't have to maintain a separate mongo instance (and they are no plans for Splice to migrate to the KV Store at the moment).

View solution in original post

cleroux_splunk
Splunk Employee
Splunk Employee

Short answer, no.

Soltra Edge has its own schema and Splice do not know anything about it. That's exactly why protocol such as TAXII have been developed. What you can do is having your Soltra Edge collecting one or multiple TAXII feeds and then Splice or Splunk Enterprise Security will collect the aggregated results through TAXII.

Enterprise Security leverage the KV Store to store IOCs so you don't have to maintain a separate mongo instance (and they are no plans for Splice to migrate to the KV Store at the moment).

Ovi
Path Finder

Thanks Cedric. It makes sense.
I just wanted to confirm my understanding before putting forward the solution design

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...