Implementing a Incident management system

[chimbudp]

We are planning to implement INCIDENT MANAGEMENT system in Splunk.
For that we need to integrate a ticketing tool with Splunk.
I have seen the Splunk Enterprise Security app which is similar to what we try to implement.
Is there any ideas on this ?

[chimbudp]

Thats cool. But , will i be getting the conf files and other property files ?

[chris]

I think, that the easiest way to "integrate" a ticketing tool with Splunk ist to set up alerts and trigger a script that will create a ticket in your existing ticketing tool ( via whatever interface the tool offers).There is documentation here

The Enterprise Security app does have a workflow implemented to deal with the notable events(which are more or less incidents) that are created. Both of those are part of ES though and not available out of the box in a standard Splunk installation.

[chris]

Oh, if you want to have ticketing information in Splunk it will depend on the ticketing tool and it's interfaces. If there is an interface that is exposed to the network (REST ... ) you might be able to get the information from a different machine than the ticketing server.

[chimbudp]

Without installing forwarder , cant we achieve this?

[chimbudp]

I need to set up a forwarder in the ticket tool server . there i need to configure the scripted inputs to get the ticket detials and populate in Splunk.
Problem here is Ticket Tool domain control is with another stream of business , where they provide access to install UF.

[Ayn]

Get the Enterprise Security app? 😃