×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
qq-stan
Explorer
Member since: ‎08-18-2022
Thursday
Community Statistics
Posts 7
Solutions 0
Karma Given 3
Karma Received 0
Member Since ‎08-18-2022
Activity Feed
View All

Re: SentinelOne app for Splunk API settings

by in All Apps and Add-ons
‎05-20-2025 11:38 PM
‎05-20-2025 11:38 PM
I think for distributed systems we have to install all: IA, TA, and the app.  I think when they say " Do not install Add-Ons and Apps on the same system" They mean not on a same host. ... View more

Re: SentinelOne app for Splunk API settings

by in All Apps and Add-ons
‎05-20-2025 09:26 PM
‎05-20-2025 09:26 PM
Also testing API on a API dev tool  indicated that we have to append "ApiToken" at the beginning of the key. Hopefully that is the way to enter it for the S1 App also. ... View more

Re: SentinelOne app for Splunk API settings

by in All Apps and Add-ons
‎05-18-2025 09:28 PM
‎05-18-2025 09:28 PM
Have you installed IA and TA as well? ... View more

Re: SentinelOne app for Splunk API settings

by in All Apps and Add-ons
‎05-18-2025 08:18 PM
‎05-18-2025 08:18 PM
Thank you for the response. Unfortunately doesn't answer to my specific question. ... View more

SentinelOne app for Splunk API settings

by in All Apps and Add-ons
‎05-18-2025 07:45 PM
‎05-18-2025 07:45 PM
So this app has three parts IA, TA, and main App itself. Installed IA on a forwarder, TA on the Cluster Master, and App - on the search head. All three have API configuration options. So where we enter API settings? I hardly imagine entering on all three. ... View more
Labels

Re: Enterprise Security- How to Add Threat Intell...

by in Splunk Enterprise Security
‎08-07-2023 07:30 AM
‎08-07-2023 07:30 AM
Thank you, @meetmshah  "Cisco Threat Grid Add-On" is not exactly what I am looking for.  My objective is to feed ES with the MCAP threat intelligence from https://mcap.cisecurity.org/ using its API key/token, if that possible. Thank you for your response. ... View more

Enterprise Security- How to Add Threat Intelligen...

by in Splunk Enterprise Security
‎07-25-2023 11:35 AM
‎07-25-2023 11:35 AM
Splunk ES documentation https://docs.splunk.com/Documentation/ES/7.1.1/Admin/Downloadthreatfeed#Add_a_URL-based_threat_source  describes how to Add a URL-based threat source and it seems work even with credential using POST. What if I have to use API Key instead of credentials? How to download Threat Intelligence from a remote API using API Keys? From  MCAP https://mcap.cisecurity.org/ for instance. Thank you for your time in advance. ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
Thursday
Karma given to
View All