API call to Splunk AI Assistant

[pruthviraj_k_m]

Hi all, 

We want to build a playbook with the help of HTTP request which basically tries to prompt the Spunk AI Assistant through API call. Do we have scope for that making use of Splunk AI Assistant API endpoint? I am not sure about the API endpoint that we need to refer for calling it with our own custom code with prompt as payload.

Thank You!

[phanTom · Accepted solution]

@pruthviraj_k_m I am sure that once the events ends up in Mission Control then you can use the AI assistant to summarise. If you need this done before that, or during execution then you will likely need to develop something to communicate with an external AI API. 

Splunk docs do point to more agentic AI in the future but until then I think this is the only way. 

----- If this helped please add Karma. If it resolved the issue please mark as a solution for others. Happy SOARing!! -----

[pruthviraj_k_m]

Thanks @phanTom .

I will try sending HTTP request with the help of HTTP app that we have in splunk SOAR and call the external AI.

[phanTom]

@pruthviraj_k_m I don't think there is an API that you can use for the Splunk AI Assistant, at least from what I can see online. 

Usually AI is interacted with via an MCP Server, which there is a Splunk app for. 

The other option is to wait for an app to be developed as I highly suspect one will, but as for timelines I have no idea. 

What would you be interacting with AI for in a playbook? Triage/Decisions/Summarisation/Other?

[pruthviraj_k_m]

Hey, thanks @phanTom .

Yes, we are actually trying to summarize the findings and use that as a description while creating the tickets or may be summarize the resolution notes or closure notes added by the analyst and update the same in other tools like Defender, Ticketing tools if we have corresponding alerts or tickets created for the splunk notables.

If splunk develops a separate connector (app) for Splunk AI assistant to use in SOAR playbooks that would be definitely helpful.