Torq Add-on for Splunk

Overview

Details

The Torq Add-on for Splunk enables security teams to integrate Torq's HyperAutomation platform with Splunk Enterprise and Splunk Enterprise Security. Trigger Torq workflows directly from your Splunk alert actions, or ad-hoc using Adaptive Response actions (when used with Enterprise Security).

Features:
* Alert Action Integration - Trigger Torq workflows from any Splunk alert or saved search
* Enterprise Security Support - Launch workflows as Adaptive Response actions from correlation searches and notable events
* Secure Configuration - Built-in credential management for Torq webhook integrations with authentication header support
* Customizable Payloads - Flexible JSON payload formatting to send relevant Splunk context (search results, metadata, links) to Torq workflows

Configuration

First, create a Splunk integration in Torq as documented here. Make sure to set an authentication header. Note the endpoint URL, header name, and secret.

Next, in Splunk, navigate to the Torq Add-on for Splunk app. Click "Add integration" and enter the
endpoint URL, header name and secret you created in the previous step. Click save.

Now you can trigger your Splunk integration from an alert, correlation search, or ad-hoc as an adaptive response action.

Triggering from a Splunk alert

Find your alert on the "Searches, reports, and alerts" page and click Edit->Edit Alert.
Scroll down to "Trigger Actions", click "Add Actions", and select "Trigger Torq Workflow".
Select the integration you created, and if you wish, customize the payload.
Click save.

Triggering from an Enterprise Security correlation search

Navigate to Configure->Content->Content Management.
Click your correlation search to edit it.
Scroll down to "Adaptive Response Actions" and click "Add New Response Action", then finally "Trigger Torq Workflow".
Select the integration you created, and if you wish, customize the payload.
Click save.

Triggering ad-hoc from Enterprise Security's Incident Review page

Select a notable event and click the arrow in the "Actions" column.
Click "Run adaptive response action", click "Add New Response Action", then finally "Trigger Torq Workflow".
Select the integration you created, and if you wish, customize the payload.
Click run.
With the notable event expanded, click the refresh icon next to "Adaptive Responses".
If the status is "Success", you have successfully triggered your Torq workflow. If not, click "View Adaptive Response Invocations" for information that can help troubleshoot.

Release Notes

Version 1.0.0

Sept. 10, 2025

Initial publication

Downloads

Share Subscribe

Version

Built by

Michael Natkin

Support

Questions on Splunk Answers Flag as inappropriate

App Contents: Alert Actions

Compatibility

Products: Splunk Cloud

Splunk Versions: 10.0, 9.4, 9.3, 9.2, 9.1, 9.0

Platform: Platform Independent

CIM Versions: 6.x

Licensing

Third Party Developer EULA

Category & Contents

Categories: Security, Fraud & Compliance, Investigative

App Type: Add-on

Subscribe Share

My Account

Support & Services