Splunk SOAR integration

Procedure

1. In the TrendAI Vision One™ console, obtain the endpoint URL and authentication token.
   1. Go to Workflow and Automation → Third-Party Integrations.
   2. Locate and click the Splunk SOAR card.
   3. Click to copy the Endpoint URL.
   4. Click Generate and copy the Authentication token.
2. Download and install the Trend Vision One for Splunk SOAR connector from Splunkbase.
   1. Go to Splunk and select Splunkbase from the Resources drop-down.
   2. Search for and download the Trend Vision One for Splunk SOAR connector.
   3. Install the connector.
3. Use the endpoint URL and authentication token to configure the integration in the Splunk console.

   Note For more information on configuring the integration, see Splunkbase - Trend Vision One for Splunk SOAR.

   1. In the Splunk console, go to Apps → Trend Vision One for Splunk SOAR.
   2. Go to Configuration → Application Settings.
   3. Paste the Endpoint URL and Authentication token copied from the TrendAI Vision One™ console.
   4. Click Save.
      Splunk begins collecting XDR data from TrendAI Vision One™. Splunk can only collect XDR data generated after connecting to TrendAI Vision One™. You might need to allow some time before new XDR data starts to appear.