AiStrike Documentation
AiStrike Documentation
Breadcrumbs

Splunk

Integrate AiStrike with your Splunk Enterprise instance so it can fetch security events and alerts via the Splunk API and user account, and tune existing detections.

Prerequisites

  • Your Splunk Enterprise instance is reachable from AiStrike.

  • A Splunk Admin account with permission to create users and generate/manage API tokens.

1. Create a Splunk user

  1. In Splunk Enterprise, go to Settings → Users and click New User.

  2. Enter a name (e.g. aistrike_integration) and a secure password — these become the Username and Password in AiStrike.

  3. Under Assign Roles, select the User role.

  4. Uncheck "Require password change on next login" and click Create.

Permissions to tune existing detections

To let AiStrike review and tune your existing detections/searches, the integration user needs extra capabilities. Either modify the default User role, or create a custom role (Settings > Roles > New Role, e.g. AiStrike_Role, inheriting User) and add:

  • rtsearch — run real-time searches

  • edit_saved_search — edit saved searches you own

  • edit_saved_search_owner — edit saved searches owned by other users

  • schedule_search — schedule a search

  • list_settings — list knowledge objects and search settings

  • admin_all_objects — view/update saved searches owned by others (required for the AiStrike Detection Engineering module)

Ensure your Splunk "Searches, Reports, and Alerts" are viewable by Everyone or the User role assigned to aistrike_integration.

2. Create an API token

  1. Go to Settings > User and Authentication > Tokens.

  2. Set User and Audience to aistrike_integration, skip Expiration and Not Before, and click Create.

  3. Copy the token (validate its start and end) and share it with AiStrike.

If you enforce IP restrictions, allowlist these AiStrike IPs:

3.135.165.25/32     3.148.24.98/32     3.148.93.249/32
3.14.192.137/32     13.201.28.59/32    18.223.178.199/32
52.15.138.222/32    54.246.180.34/32   63.35.37.74/32
54.220.227.162/32

3. Connector configuration

Field

Source

Server

Hostname or IP of your Splunk instance (e.g. https://prd-example.splunkcloud.com or <splunkIP:port>)

Username

The Splunk user created above

Password

Password for that user

Token

The API token created above

In AiStrike, go to Integrations > Available Integrations, search for Splunk, add a configuration, enter the server/port and authentication details, and click Save.