Red Dragon Technology Alliance Program

Scout App for Splunk

Enrich Splunk, accelerate IR and enhance investigations with Real-time IP Intelligence

Team Cymru + Splunk

Enhance Your Security Operations With Real-Time IP And Domain Intelligence

Splunk customers benefit from real-time IP and domain intelligence through a partnership with Team Cymru. Accelerate incident response, enhance investigations, and reduce false positives by enriching Splunk dashboards with the world's largest IP data ocean.

Quickly identify and mitigate threats with real-time data.
Gain deeper insights and context for thorough investigations
Improve accuracy and efficiency by minimizing false alerts

Splunk integration with Team Cymru, product view

Use Cases

Enrich any IP address with insightful context, tags and metadata

Gather detailed views of IP address relationships, including communication patterns, open ports, passive DNS data, X509 certificates, fingerprints, and WHOIS information.

Provide Real-time Context to Splunk Investigations

Obtain critical information about multiple IP addresses that appear in alerts or security incidents

Domain and IP Research

Leverage the world's largest data ocean to quickly and easily triage and investigate any IP address, or domain. Search a single IP or bulk research by querying up to 10 IP addresses at once. Empower SOC teams with context to accelerate IR and investigations.

Log Management

Enhanced Log Management with Team Cymru Scout App for Splunk

Parsing, Normalizing, & Analyzing Logs

As the Team Cymru Scout App ingests logs, they are parsed, normalized, and stored within Splunk. This enables you to write detections, identify anomalies, and conduct investigations across extensive datasets.

Normalization: The app applies standardized fields to log records allowing for consistent attribute names and facilitating data correlation across multiple sources.

Analysis Tools: Utilize Splunk's search tools, such as the Search Processing Language (SPL), to investigate your normalized logs for suspicious activities or vulnerabilities

Splunk screenshot: Parsing, Normalizing, & Analyzing Logs

Built-In And Easily Customizable Detections

Pre-built Detections: Access default detections tailored for common threats and IoCs.

Custom Detections: Leverage Splunk's powerful SPL to create custom detection logic, allowing you to define rules specific to your organization's needs

Splunk screenshot: Built-In And Easily Customizable Detections

Configuring Alerts

The app generates alerts based on your configured detection rules and policies. These alerts can be integrated with various destinations for intuitive management and remediation.

Severity Levels: Alerts are categorized into different severity levels -- Info, Low, Medium, High, and Critical. Customize these levels based on specific log event attributes.

Alert Destinations: Integrate alerts with Splunk's alert actions to send notifications to email, Slack, or other SOAR platforms

Getting Started

Integration with Splunk is easy. Follow these steps

Step 1

Download Scout App

Download and install the Team Cymru Scout App from Splunkbase.

Step 2

Configure data inputs

Detection-as-Code boosts Splunk efficiency instantly. Create detections easily.

Step 3

API key setup

Detect threats in real-time and searchable security data for one year.

Step 4

Intuitive

Detect threats in real-time and searchable security data for one year.

Download Scout App

Install and configure the Splunk App from Splunkbase

Customer Voice

Loved by SOC Analysts

Pure Signal Scout provides all the details I need when investigating an IP address or domain in one handy location. I really like the ability to use the graphs to see activity over the last 30 days on a day-by-day basis.

David M.

Pure Signal Scout provides a detailed and structured view of the queried IP address or domain. It is quite easy to use and has a very clean interface. I really like how it provides a visual of the timeline regarding the open ports, IP tags, etc.

Asad A.

Scout Insight is a one-stop shop for all threat investigations. I perform detailed IP and domain source analysis and see suspected threat tags on domains in one platform without ever needing to leave the product.

Noah F.

Why Team Cymru

Why Team Cymru and Splunk Are a Winning Combination

Team Cymru and Splunk provide a robust solution for comprehensive cybersecurity and threat intelligence. Team Cymru's detailed threat intelligence feeds and extensive data on IP address relationships, combined with Splunk's powerful data analysis and visualization capabilities, create a powerful synergy.

Splunk's ability to ingest, normalize, and analyze vast amounts of data is complemented by Team Cymru's real-time threat intelligence, enabling security teams to detect and respond to threats swiftly and effectively. This integration allows organizations to gain deeper insights into their network activities, identify and mitigate potential risks, and maintain a proactive security posture.

By leveraging the strengths of both platforms, security teams can streamline their workflows, enhance their threat detection and response capabilities, and ultimately protect their digital assets more efficiently.

Enrich Splunk, accelerate IR and enhance investigations with Real-time IP Intelligence

With the Team Cymru Scout App for Splunk, your security team can efficiently manage threat intelligence and digital risk without the overhead associated with traditional SIM solutions

Contact Sales

Partner Portal