SOAR Automation with Darktrace APP

[Nraj87]

Security alerts generated by Darktrace are currently converted into incidents within Splunk for investigation. Once the analysis team completes the review and formally closes an incident, propose an automated process that will immediately confirm this action back to Darktrace as well. the automation SOAR is designed to automatically acknowledge and update the status of the corresponding Darktrace alert.

please advise how Splunk Notable data from notable index can be sent TO SOAR or pull by SOAR from Splunk ES

[phanTom]

@Nraj87 you can send to SOAR from ES using the Adaptive Response:

https://help.splunk.com/en/splunk-soar/splunk-app-for-soar-export/4.3.25/send-data-between-the-splun... 

Or you can use the Splunk app on SOAR to poll the notable index and it will create SOAR cases for each one ingested. 

-- Hope this helps! If so please mark with Karma, or mark as a Solution if this resolved your issue. Happy SOARing! --