VulnCheck Exploit Intelligence App For Splunk

OVERVIEW

The VulnCheck Exploit Intelligence App for Splunk empowers security teams to enrich CVE data with real-world exploitation intelligence directly inside Splunk. By integrating VulnCheck's comprehensive APIs, the app delivers enriched vulnerability insights, SBOM-driven risk analytics, and threat actor correlation, enabling customers to prioritize vulnerabilities based on active exploitation and real risk, not just static CVSS scores.

COMPATIBILITY MATRIX

RECOMMENDED SYSTEM CONFIGURATION

• Standard Splunk Enterprise configuration of Search Head, Indexer and Forwarder.

RELEASE NOTES

Version 1.0.0 (Initial Release)

Core Features:

• CVE Enrichment Engine - Comprehensive CVE enrichment with VulnCheck's exploitation intelligence
• SBOM Risk Analysis - Upload and analyze SPDX/CycloneDX SBOM files for vulnerability assessment
• Interactive Dashboards - Executive Overview, CVE Explorer, SBOM Risk Analyzer, and Reporting dashboards
• Custom Visualizations - Vulnerability priority pyramids, exploitation timelines, and threat intelligence displays
• Notable Event Integration - Automatic enrichment of Splunk ES notable events with CVE intelligence
• Adaptive Response Actions - Enrich IP addresses and CVEs from notable events with VulnCheck Intelligence data

INSTALLATION

VulnCheck Exploit Intelligence App for Splunk can be installed through UI as shown below. Alternatively, .tar or .spl file can also be extracted directly into $SPLUNK_HOME/etc/apps/ directory.

1. Log in to Splunk Web and navigate to Apps > Manage Apps.
2. Click Install app from file.
3. Click Choose file and select the VulnCheck Exploit Intelligence App for Splunk installation file.
4. Click on Upload.
5. Restart Splunk if prompted.

Deployment Topologies

1. Standalone Mode

• Install the VulnCheck app on the Splunk instance
• Configure API key and start enrichment processes
• All functionality available on single instance

2. Distributed Environment

• Search Head: Install app and configure dashboards, correlation searches
• Indexers: Install app for custom commands and data processing
• Heavy Forwarders: Install app for data collection and enrichment
• Configure KV store settings on forwarders
• Configure correlation settings on search heads only

3. Cloud Environment

• Install app on Splunk Cloud search heads
• For data collection, install on IDM instance or on-premise heavy forwarders
• Work with Splunk support team for IDM configuration

CONFIGURATION

Prerequisites

Before configuring the VulnCheck app, ensure you have:

• VulnCheck API Key - Obtain from your VulnCheck account
• Splunk Admin Access - Required for app configuration
• KV Store Enabled - Verify KV store is enabled in Splunk
• Network Connectivity - Access to api.vulncheck.com (configure proxy if needed)

Optional:

• Splunk Enterprise Security - For notable event enrichment and adaptive response actions
• Splunk Common Information Model (CIM) - For CIM-based vulnerability data enrichment

Account Configuration

To Configure:

1. Navigate to VulnCheck App > Configuration
2. Enter your VulnCheck Premium API Key
3. Click Save

Proxy Configuration

Configure proxy settings if your environment requires proxy access to external APIs.

To Configure:

1. Navigate to VulnCheck App > Configuration > Proxy
2. Check Enable checkbox
3. Enter proxy details
4. Click Save

Logging Configuration

Configure logging levels for troubleshooting and monitoring.

To Configure:

1. Navigate to VulnCheck App > Configuration > Logging
2. Select desired log level from dropdown (DEBUG, INFO, WARNING, ERROR)
3. Click Save

Enrichment Configuration

Configure automated enrichment of vulnerability data from various sources.

To Configure:

1. Navigate to VulnCheck App > Configuration > Enrichment
2. Configure enrichment parameters
3. Click Save

SBOM Risk Analysis Configuration

Upload and analyze Software Bill of Materials files for vulnerability assessment.

To Configure:

1. Navigate to VulnCheck App > Configuration > SBOM Risk Analysis
2. Upload SBOM file and configure parameters
3. Click Save

Ad Hoc Enrichment

Perform one-time enrichment of specific CVEs, PURLs, or CPEs.

To Configure:

1. Navigate to VulnCheck App > Configuration > Ad hoc Enrichment
2. Select input method and provide values
3. Click Save