An analytics-driven SIEM that ingests and correlates machine data from any source across an organization's infrastructure. It provides real-time threat detection, dashboards, and integrated SOAR capabilities for SOC teams.
What is Splunk?
Splunk is a data analytics platform that has become one of the most widely deployed SIEM solutions in enterprise security operations. It ingests machine-generated data from any source, including logs, metrics, network traffic, and application events, indexes it for fast search, and provides a query language called SPL that allows analysts to write complex correlations and aggregations across massive datasets. Splunk's detection framework, powered by Splunk Security Essentials and the ESCU content library, provides hundreds of prebuilt detection rules aligned to MITRE ATT&CK. Its SOAR product, Splunk SOAR, integrates tightly with the SIEM to allow playbooks to execute response actions directly from within investigation workflows. Splunk's flexibility and extensive integration ecosystem make it a common choice for organizations with complex, heterogeneous environments that require custom detection logic and data analysis workflows.
How does Splunk work with Qevlar?
Qevlar integrates with Splunk to query log data and retrieve alerts during automated investigations. When an investigation requires searching across historical data or correlating events from multiple data sources indexed in Splunk, Qevlar can execute SPL queries directly to retrieve the relevant evidence without requiring analyst involvement.
Want to help your analysts focus on the most critical alerts?
Frequently asked questions
What does Splunk do?
Splunk is an analytics-driven SIEM that ingests and correlates machine data from across an organization's infrastructure, providing real-time threat detection, dashboards and a powerful search language for complex analysis.
What can you do with Splunk in Qevlar?
Qevlar can query Splunk for log data and alerts during an investigation, searching across historical data and correlating events from multiple indexed sources automatically — retrieving the evidence an analyst would otherwise gather by hand.
Does Qevlar investigate Splunk alerts automatically?
Yes. Qevlar takes an alert, runs the searches needed to establish context across your indexed data and reaches an evidence-backed verdict.
Can Qevlar search across multiple Splunk data sources at once?
Yes. Qevlar correlates events from across the sources indexed in Splunk to build a unified investigation narrative.
Other integrations
