Splunk SOAR
Incident Response & Ticketing
Detection & Response Enablement
Overview
Integrates OpenCTI Threat Intelligence Platform with Splunk SOAR for threat intelligence management and incident response
The OpenCTI Integration for Splunk SOAR bridges OpenCTI's threat intelligence platform with your security orchestration workflows. It enables analysts to enrich artifacts (IPs, domains, hashes, URLs), search and create STIX observables and indicators, manage threat entities (threat actors, malware, intrusion sets, campaigns, vulnerabilities), and handle cases (Incident, RFI, RFT) — all without leaving Splunk SOAR. Bulk operations and relationship creation keep your OpenCTI knowledge base in sync with active investigations.
Basic information
Filigran
Romain Guignard
Third party integrations
Orchestration (SOAR)
April 23, 2026
6.9.0
0