Blueprints for High-Maturity Operations: Splunk Lantern Articles on SOAR, ES 8.4, Observability, Data, and Much More!

[KayeChapman]

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key use cases for Security, Observability, Industries, AI, and Cisco. We also host valuable data source and data type libraries, Getting Started Guides for all major products, tips on managing data more effectively within the Splunk platform, and many more expert-written guides to help you achieve more with Splunk. If you haven’t visited us lately, take a look – we've recently redesigned our site to make it even easier to use and navigate. 

In this blog we’re sharing all the details on more than 30 new articles published on Lantern last month, with a particular focus on the newest best practices for scaling automation and security workflow design. From a comprehensive series on Splunk SOAR playbook architecture to a closer look at the workflow enhancements in Enterprise Security 8.4, we’re providing the blueprints to help you move from manual tasks to sophisticated, high-maturity operations. We’re also delivering new resources for observability and Splunk platform specialists, covering everything from AI-assisted thresholding in ITSI to essential best practices for managing platform certificates and app development. Read on to find out more! 

Elevate Your Automation: A Masterclass in Splunk SOAR Playbooks 

Automation is only as effective as the design behind it. This month, we’ve released a deep-dive collection of articles focused on Using SOAR automation to improve your SOC processes. This series moves beyond basic "if-this-then-that" logic to help you build a resilient, documented, and scalable automation practice. 

Standardizing Your Development 

• Understanding playbook types in Splunk SOAR – Learn how to categorize your workflows into input, automation, and orchestration playbooks for better organization. 
• Applying useful SOAR playbook design features and Improving SOAR playbook design – Master the visual and logical best practices that make playbooks easier to maintain. 
• Using a documentation-as-code approach to playbook development – Discover how to treat your automation documentation with the same rigor as your software code. 

Advanced Investigative Workflows 

• Building a SOAR playbook for container enrichment and leveraging lookup tables – Automate the context-gathering phase so analysts have everything they need the moment they open a case. 
• Building a SOAR playbook for a user-focused security investigation – Shift your automation focus towards identity and behavior-based analysis. 
• Building a SOAR playbook to run SPL eval functions – Integrate the power of Splunk SPL into your automated actions. 

Governance and Remote Actions 

• Earning approval for automation activities in your organization and Building a SOAR playbook for user-initiated approval of automation – Build the necessary trust and "human-in-the-loop" checkpoints for sensitive automated actions. 
• Building a SOAR playbook for running commands remotely and running scripts remotely – Extend your SOAR platform's reach to take direct action across your distributed infrastructure. 

Modernizing the SOC: Enterprise Security 8.4, AI App Security, and Data Onboarding Maturity 

As security environments grow more complex, the tools we use to manage them need to become more intuitive. This month, we’ve released several new articles focusing on the technical updates in the latest version of Splunk Enterprise Security 8.4, providing a framework for monitoring AI-driven applications, and helping you build a model for security data onboarding that’s tailored to your organization’s needs. 

• The release of Splunk Enterprise Security 8.4 brings significant changes to how analysts manage their daily workflows. We’ve documented these updates for both Premier and Essentials users in a resource that complements the course content in ES 8.0 Updates for the Splunk SOC. This information will help you navigate the new interface and leverage the latest feature enhancements to speed up your detection and response times. 

• With the rapid adoption of AI apps used by organizations of all kinds, security teams are facing entirely new attack vectors. Understanding and defending against threats to AI apps provides an essential framework for identifying and mitigating risks unique to AI applications, such as prompt injection and sensitive data exposure, through combining Cisco AI Defense with Enterprise Security. 

• High-fidelity security outcomes are impossible without high-quality data. Use the maturity model shown in Using a security data onboarding maturity model to assess your current onboarding processes and create a roadmap for building a more sophisticated and reliable data pipeline. 

What Else is New? 

Beyond our focus on security best practices, this month we’ve published a wide range of articles covering observability, industry-specific use cases, and platform health: 

Observability & ITSI 

• Using AI-assisted thresholding in Splunk ITSI – Reduce the manual effort of alert tuning by using AI to provide threshold adjustment recommendations for your services. 
• Configuring bidirectional ticketing in ITSI – Streamline your incident response by synchronizing ITSI episodes with external service desks, ensuring status updates and resolutions flow seamlessly between both systems. 
• Improving KPI, entity, and advanced configurations with the ITSI Configuration Assistant – Use the ITSI Configuration Assistant to identify gaps in your setup and optimize the health of your service monitoring environment. 

Industry & Global Operations 

• Sharing information in a global operation – Learn best practices for maintaining visibility and secure data sharing across geographically distributed teams using Cisco and Splunk integrations. 
• Solution Accelerator for Data Compliance Pipelines – A dedicated guide for financial institutions to build data pipelines that meet strict regulatory requirements for lineage, retention, and auditability. 
• Gaining insight about in-store retail customers – Discover how to use Cisco cameras and sensors with Splunk software to analyze customer foot traffic, transaction issues, and engagement in physical retail locations. 
• Monitoring facilities with differing applications – Strategies for centralizing visibility across multiple retail facilities that might be running different technology stacks or localized applications. 

Platform & App Development 

• Monitoring physical and natural environments with AI and Splunk Edge Hub – Use Splunk Edge Hub sensors combined with AI models to monitor environmental factors like people movement and physical site safety. 
• Using grok custom classifiers to improve your Federated Search experience – Enhance your FS-S3 capabilities by using custom grok patterns to parse and structure unstructured log data more effectively. 
• Updating server and client certificates to comply with industry-wide changes – A technical guide on the steps required to update Splunk certificates in response to evolving industry security standards and certificate expiration requirements. 
• Using best practices for developing Splunk apps – Core principles and standards for building performant, secure, and maintainable applications for the Splunk platform. 
• Understanding commonly used extension points – A reference guide to the most common extension points available for customizing and extending the functionality of your Splunk deployment. 

We hope these expert-written resources help you get even more value out of your Splunk deployment. Thanks for reading! 

- Kaye Chapman, Senior Lantern Content Specialist for Splunk Lantern