Splunk SOAR

The OpenCTI Integration for Splunk SOAR bridges OpenCTI's threat intelligence platform with your security orchestration workflows. It enables analysts to enrich artifacts (IPs, domains, hashes, URLs), search and create STIX observables and indicators, manage threat entities (threat actors, malware, intrusion sets, campaigns, vulnerabilities), and handle cases (Incident, RFI, RFT) — all without leaving Splunk SOAR. Bulk operations and relationship creation keep your OpenCTI knowledge base in sync with active investigations.