Work goes outSIEM & SOAR
Splunk
Streams findings to Splunk as OCSF vulnerability_finding events over HEC, so your detection content can correlate exposure with what is happening on the wire.
What the connector does
- Findings delivered as OCSF class 2002 events, against a pinned schema
- HTTP Event Collector, with the index and sourcetype you choose
- Queued and retried delivery with a dead-letter for anything the receiver rejects permanently
- Status changes delivered too, so a Splunk dashboard is not a snapshot of the day it was built
Credential required
A HEC token for the index you name. Nothing is read from Splunk.
What this connector is for
A SOC that can see an exploit attempt but not whether the target is vulnerable is guessing. Delivering findings into the SIEM closes that gap: the same search that spots the attempt can ask whether the host it was aimed at has the weakness being aimed at.
What is delivered
Findings serialised as OCSF vulnerability_finding events — class 2002 — carrying the asset, the CVE,
the severity, the status and the timestamps. The schema is pinned and bundled rather than fetched: a
serializer validated against the live specification would start emitting a renamed field the day OCSF
shipped one, silently changing what your correlation rules match on.
How delivery behaves
Through the same durable outbound queue every other destination uses. A delivery that fails transiently is retried with backoff; one the receiver rejects permanently goes to a dead-letter with the reason attached, rather than being retried forever or dropped quietly.
What you have to grant
An HTTP Event Collector token scoped to the index you want the events in. This connector only writes — it runs no searches and reads nothing back.