SOCRadar Splunk Integration: New MSSP and Vulnerability Apps

Your analysts live in Splunk. Your external risk does not: SOCRadar alarms for dozens of managed companies, and vulnerability findings across an attack surface that changes every day. Why should seeing either one still mean another console, another input per customer, or another spreadsheet of CVEs?

Today we are releasing two new SOCRadar apps on Splunkbase at the same time: SOCRadar Incidents MSSP and SOCRadar Vulnerability.

Multi-Tenant SOCs Outgrow Single-Tenant Integrations

Most SIEM integrations are built for a single organization. That works until you are an MSSP, or an enterprise with many subsidiaries. Then every new customer means another input to configure, another API key to rotate and another dashboard to clone. The bigger risk is data mixing: when alarms from several companies land in the same index without a reliable tenant label, a search, report or alert can easily cross customer boundaries.

Vulnerability Findings That Never Reach the SIEM Never Get Prioritized

External vulnerability findings, such as exposed services, outdated software with known CVEs and weak mobile app builds, are usually reviewed in a separate tool. They rarely sit next to the asset, identity and network data that would tell you which ones matter most, and closing a finding means switching back to yet another console.

The SOCRadar Capability Behind These Apps

Both apps are powered by the SOCRadar platform, which correlates findings from Cyber Threat Intelligence, Brand Protection, Dark Web Monitoring and External Attack Surface Management into prioritized, validated alarms. Use cases covered include:

• Leaked credentials and exposed PII across all managed companies
• Impersonating domains, social media accounts and mobile apps per customer
• Exposed services and known CVEs on your external attack surface
• Insecure mobile application builds found by Mobile Application Security

SOCRadar Incidents MSSP

SOCRadar Incidents MSSP brings incidents for every company you manage into Splunk.

One input, all companies. Configure a single input with your Multitenant API Key and Multi-Tenant ID, and incidents from every managed company start flowing into Splunk.

Tenant-safe data. Every alarm keeps the company it belongs to, so searches, reports and alerts never mix tenants.

MSSP Overview dashboard. Alarms, severities and trends per company, with a company filter on every dashboard.

Bi-directional status updates. Update an alarm’s status in SOCRadar directly from Splunk and keep both sides in sync.

SOCRadar Vulnerability

SOCRadar Vulnerability brings your SOCRadar vulnerability findings into Splunk.

Attack Surface and mobile findings. Collect Attack Surface Management findings, with Mobile Application Security findings as an option.

Incremental collection. Each run writes only new or changed data, so the index stays clean and free of duplicates.

Built-in dashboards. Severity, affected assets, CVEs and alarm status at a glance, plus a tutorial page for setup.

Close alarms from Splunk. Once a finding is fixed, close the matching SOCRadar alarm without leaving Splunk.

Five SOCRadar Apps on Splunkbase

Both apps support Splunk Enterprise and Splunk Cloud. With this release, Splunk customers have five SOCRadar apps:

• SOCRadar Incidents: alarms and incidents for a single company
• SOCRadar Threat Feeds: threat intelligence indicators from SOCRadar feed collections
• SOCRadar TAXII 2.1: STIX 2.1 indicators from the SOCRadar TAXII 2.1 server
• SOCRadar Vulnerability, new: ASM vulnerability and mobile app findings, dashboards, and alarm closure from Splunk
• SOCRadar Incidents MSSP, new: multi-company incidents with per-company dashboards and status sync

How It Works in Practice

It is Monday morning and the MSSP Overview dashboard shows a spike in critical alarms for one of your customers, Acme Bank. You filter to Acme Bank and see leaked-credential alarms from a Dark Web market, so you hand them to the customer’s identity team and mark the alarm Investigating directly from Splunk; the status is written back to SOCRadar.

In the same Splunk instance, the SOCRadar Vulnerability dashboard flags a new critical CVE on vpn.acme.com. The team patches the server, and you close the alarm from Splunk. Both the incident and the vulnerability were handled without leaving the SIEM.

Take the Next Step

Install SOCRadar Incidents MSSP and SOCRadar Vulnerability from Splunkbase, add an input with your SOCRadar API credentials, and open the built-in dashboards. Your SOCRadar customer success manager can help with setup. Not yet a SOCRadar customer? Request a demo.

Learn More

• SOCRadar Incidents MSSP on Splunkbase
• SOCRadar Vulnerability on Splunkbase
• Splunk Enterprise
• All SOCRadar integrations
• Request a demo