It's time for some long-overdue changes to the Splunk apps that integrate Splunk SOAR into our Splunk Cloud and Enterprise offerings. Here's a quick summary: The Phantom App for Splunk will be renamed to Splunk App for SOAR Export The following three apps will be combined into one app and be called Splunk App for SOAR Phantom Remote Search Splunk Add-On for Phantom Splunk App for Phantom Reporting This helps reduce confusion about what each app does and simplifies the installation and configuration process. And of course it's about time we moved on from calling things "Phantom" around here! To help remember the differences between the two apps, I find it helpful to think about it this way: Splunk App for SOAR Export - exports data from Splunk to SOAR Splunk App for SOAR - imports data from SOAR to Splunk How are we going to combine those three apps into one app without making it a huge hassle? Glad you asked. If you currently have "Phantom Remote Search" installed, that app will update in-place with the name change and additional functionality from the other two apps. Users who have "Splunk Add-On for Phantom" or "Splunk App for Phantom Reporting" are encouraged to use the new Splunk App for SOAR as that will be the app receiving updates moving forward. What do you think of these changes? If you have any questions, please leave a comment below! — Matt Sayar, Product Manager, SOAR Apps ... View more

A few weeks ago, we mentioned we're moving our open source SOAR apps to a new space on GitHub. On December 2nd, we're doing something even more exciting: we're moving ALL of our app source code to GitHub! As Splunk continues to embrace open source, this is a major step in allowing our customers to take a peek into how things work and perhaps even help out the rest of the community by making contributions. These GitHub repositories will be our single centralized location for SOAR app source code moving forward. We look forward to seeing the benefits of how this transparency helps you automate your tools with SOAR! How is this different from our previous announcement? Last time we simply moved apps that were already open-sourced from one GitHub org to another. This time, we're taking apps that were previously only available in-house to everybody. From now on, all of our app source code will be open source from the very beginning. All 350+ apps! How does this help you out day to day? There are many benefits to open source software, but for most folks, business will continue as usual. For those with Python development skills, this is somewhat of a game changer. We always offered source code to anybody who asked, but this eliminates any barriers to getting access to it. Combined with our new in-product app editor, Splunk is really putting the power in your hands. Of course, you don't HAVE to do any coding to get all the great benefits Splunk SOAR offers, but there's a lot of power in letting you gracefully drop into code if you need to tweak just one little thing. Why is the new repo called "Splunk SOAR Connectors?" I thought they're called apps. Oh you noticed that! We're slowly moving away from calling them "apps" and will call them "connectors" in the future. You can call them apps or connectors for now; they're interchangeable at this point. I'd probably still describe them as apps to my mom, but since they're connecting SOAR to various services we feel that makes more sense moving forward. -- Matt Sayar, Product Manager for Splunk SOAR Apps (er, Connectors!) ... View more

Today, many SOAR apps live on GitHub in a monorepo. This has helped many users explore the apps' internal code, understand how they work, and even make contributions. But this repo didn't hold all our apps, and I'm happy to announce that starting Tuesday, November 9th, ALL of our Splunk SOAR apps will be open-source and live in a new GitHub organization! What's changing? We're breaking up that monorepo to allow each app to live in its own repository. This gives us and our partners greater control of each app's updates. Does this change the contributions process? Only slightly. You can always check our Contribution Guide for the latest updates. What else can I do with the new repo? You can submit GitHub Issues for individual apps, view the app's documentation, and see its source code all in one place. Wait, can I still contact Splunk Support if I have an issue with an app? You can always contact Splunk Support for Splunk-supported apps. Submitting GitHub Issues or pull requests for everything else is a valuable way to get involved in our community. I'm a vendor and want to be a Maintainer for my product's repository. What do I do? Get involved with Splunk's Technology Alliance Partners program and let's do it! Questions? Comments? Let us know below, and we hope you enjoy the new organization! -- Matt Sayar, Product Manager for Splunk SOAR Apps   ... View more