Analyst1
Overview
Details
This add-on brings enrichment data around observables/indicators of compromise from Analyst1 into Splunk, providing lookup tables for correlation data.
The Analyst1 App for Splunk is an add-on designed for use by existing Analyst1 customers.
This add-on brings enrichment data around observables/indicators of compromise from Analyst1 into Splunk, providing lookup tables for correlation data and some sample dashboards to get users started. All of this is accomplished with outbound connections from Splunk to Analyst1, avoiding complex firewall configurations.
For setup and operations help, open the Analyst1 Documents portal site and look for the Analyst1 App for Splunk Guide.
Release Notes
Version 1.3.0
Resolves two issues. (1) Redresses when other TAs/Apps introduce malformed passwords the Account page would not always render. (2) Allows each Account to explicitly trust an optional public certificate to handle organizational/non-standard CA issued certificates.
Version 1.2.0
Version 1.2.0 enhances our support for Outputs, a way to get indicator sightings (what Analyst1 calls Hit Stats) from Splunk into the Analyst1 platform, by redressing an issue with the API submission wrongly preserving log files on the Splunk infrastructure. It also implements all change required to maintain current Splunk Cloud compatibility, both Victoria and Classic.
Version 1.1.0
Version 1.1.0 includes beta support for Outputs, a way to get indicator sightings (what Analyst1 calls Hit Stats) from Splunk into the Analyst1 platform.
Version 1.0.0
Initial release