Splunk Enterprise Security — Integration Setup

Prerequisites

• Splunk Enterprise with the Splunk Enterprise Security (ES) app installed and generating notable events
• Token-based authentication enabled on the Splunk instance
• Network access from CMDash's sync workers to Splunk's management port (default 8089)
• CMDash Essentials tier or above

Step 1: Enable Token Authentication and Create a Token

1. In Splunk Web, go to Settings → Tokens. If token auth is disabled, enable it (requires a admin_all_objects-capable account the first time).
2. Click New Token.
3. User: choose a dedicated service account (or your existing svc_cmdash account) with a role that can run searches (search capability) and read the ES notable index/macro — the built-in ess_analyst role or a custom equivalent works well.
4. Audience: CMDash Integration. Set an expiration consistent with your rotation policy.
5. Copy the generated token — it is shown only once.

Step 2: Connect in CMDash

1. Navigate to Integrations in your CMDash dashboard.
2. Find Splunk Enterprise Security and click Connect.
3. Enter:
   • Base URL — your Splunk management endpoint, e.g. https://splunk.yourcompany.com:8089 (required — if left blank the adapter defaults to https://localhost:8089, which will not reach your Splunk instance from CMDash's sync workers)
   • Token (stored as this connection's access token, sent as Authorization: Bearer <token>)
4. Click Save & Test Connection.

What Syncs

CMDash runs a search job against your ES notable macro/index, scoped to the last 24 hours, waits for it to finish and reads the results page by page (500 per request, up to 20,000 notable events); reaching that ceiling marks the sync Partial with a warning. It normalizes each notable event into a CMDash incident. Splunk urgency/severity fields map to CMDash's critical/high/medium/low scale; notable event status labels (New/Unassigned → open, In Progress/Assigned → investigating, Resolved → resolved, Closed → closed) map onto CMDash's incident status.

This integration is read-only. Unlike Jira and ServiceNow, the Splunk adapter does not currently expose a write-back path (e.g., updating a notable event's status or disposition from CMDash).

Troubleshooting

• Connection fails / times out: The most common cause is the Base URL still pointing at the default https://localhost:8089 placeholder — set it explicitly to your Splunk management endpoint, reachable from CMDash's sync workers (check firewall rules for port 8089).
• 401 Unauthorized: The token expired (if you set an expiration) or was revoked; generate a new one.
• 403 Forbidden / empty results: Confirm the token's user has the search capability and can query the ES notable index — a user without ES app access will get zero results rather than an explicit error.
• notable macro not found: This adapter assumes Splunk Enterprise Security is installed; a vanilla Splunk Core instance without ES has no notable macro and the search will fail.

Rate Limits & Sync Behavior

Credential Rotation

Splunk auth tokens can be issued with an expiration date. CMDash recommends setting one (90 days is a reasonable default) rather than a non-expiring token.

To rotate:

1. In Splunk: Settings → Tokens, create a new token for the same service account.
2. In CMDash: Settings → Integrations → Splunk Enterprise Security → Edit.
3. Enter the new Token and Save.
4. Revoke the old token in Splunk once confirmed working.

Note: CMDash cannot read Splunk token expiry metadata today, so the 30-day expiry warning banner is not shown for this integration — track expiration dates you set in Splunk separately.

Multiple Instances / Multi-Site

If you run separate Splunk ES deployments (e.g., one per region or business unit), each instance needs its own CMDash connection.

To add another instance:

1. Create a token in the additional Splunk deployment, following Step 1.
2. In CMDash: Settings → Integrations → Add Integration → Splunk Enterprise Security.
3. Enter the base URL and token for the additional instance.
4. Give the connection a descriptive name (e.g., Splunk - US SOC, Splunk - EU SOC).
5. Click Save & Test Connection.

Compliance Framework Coverage

The Splunk Enterprise Security integration provides evidence for the following controls. Coverage is automatically mapped when data is synced.