Skip to main content


Download With Dependencies

Run queries on Splunk servers.

This content pack runs queries on Splunk servers.

When a query or alert triggers a notable event (incident) in Splunk, the event is stored in an index (table). An XSOAR analyst can fetch the event and its context data all from the XSOAR console.

We strongly recommend you to use the SplunkPy pre-release version, specifically if you experience any issues regarding fetch logic, including (but not limited to) missing incidents.

What does this pack do?

Using the SplunkPy integration, you can fetch Splunk notable events. The events contain details such as:

  • The name of the alert that was triggered.
  • The objects that make up the alert, such as the IP address, hashes, and user names.

Besides fetching notable events, the SplunkPy integration enables you to run drill down searches to retrieve additional data from other tables in Splunk such as:

  • Data about the users (department, role, and geographical location)
  • Data about the assets (such as hostname, IP address, geographical location, and department)

In addition, the integration enables mirroring between Splunk and Cortex XSOAR.

When mirroring or fetching incidents between Splunk to Cortex XSOAR, you need to map Splunk users to Cortex XSOAR users.




Cortex XSOARCortex XSIAM


CertificationRead more
Supported ByCortex
CreatedJuly 26, 2020
Last ReleaseMarch 27, 2023

Content packs are licensed by the Publisher identified above and subject to the Publisher’s own licensing terms. Palo Alto Networks is not liable for and does not warrant or support any content pack produced by a third-party Publisher, whether or not such packs are designated as “Palo Alto Networks-certified” or otherwise. For more information, see the Marketplace documentation.