set up SOAR to receive data and send an action to the endpoints

[kareem]

How can SOAR be set up to receive data from Splunk ES, process it, send an action to the endpoints, and update the event status in Splunk ES?

[kareem]

thank you so much
do u have a way to speed up the Splunk SOAR capabilities to process the events, it can't process a 100 events every 5 minutes....
 I found a solution about the worker but, the file that solution talk about doesn't exists which is "umsgi.ini"

[kprior201]

Sorry for the delay on this; no, I don't really have an answer to that one. You might open a support ticket for advice there. In my instances, I generally tried to minimize the amount of events it was being sent.

[kprior201]

This is a pretty big question. I would recommend you start here: https://docs.splunk.com/Documentation/SOARExport/4.3.2/UserGuide/Configureoverview for how to connect Splunk and Splunk SOAR. From there, you'll need to set up the mechanism for sending alerts to SOAR and a playbook within SOAR for processing them the way you need to. What action you want to do on the endpoint will determine how to set that playbook up. If this is leveraging Defender, for example, you can set up an action to call Defender to quarantine an endpoint or something like that. It will vary a lot depending on your exact use case.

[kareem]

thank you for reply... I successfully make a connection between Splunk ES and Splunk SOAR... but I Can't make the connection between them automatically
Do you have a solation for that? 

[kprior201]

Sure, you have a couple of options there. You can either add adaptive response actions to your Splunk ES correlation searches (if you're using those) or you can set up a saved search to export exactly the results you want to. When I last worked on this (it's been about a year), I found that the saved search method was more reliable. I used a search similar to the Incident Response view search ("Incident Review - Main" in SA-ThreatIntelligence) as my use case was to forward notable events to the SOAR platform.