OpenCTI for Splunk Enterprise

Overview

OpenCTI for Splunk Enterprise connects Splunk Enterprise and Splunk Cloud to the OpenCTI platform, so security teams can use OpenCTI threat intelligence in their Splunk detection and response workflows.

It replaces the OpenCTI Add-on for Splunk, which is deprecated and no longer receives updates. Compared with the previous add-on, it:

• imports several object types, not only indicators;
• fits clustered Splunk environments and Splunk Cloud: it can write to a Splunk index, and saved searches then populate the KV Stores;
• is built on the Splunk UCC (Universal Configuration Console) framework.

Key capabilities

• Live stream ingestion: modular inputs consume an OpenCTI live stream (indicators, observables, relationships, sightings). They write either straight to the app’s KV Store collections or to a Splunk index that saved searches sync into the KV Stores.
• Alert-based actions: Splunk alerts can create incidents, incident response cases or sightings in OpenCTI. Observables are extracted from CIM fields or from octi_* fields.
• Direct investigation in OpenCTI: analysts can investigate alerts directly in OpenCTI from Splunk, with the full threat context.