Splunk Dev

Implementing a Incident management system

chimbudp
Contributor

We are planning to implement INCIDENT MANAGEMENT system in Splunk.
For that we need to integrate a ticketing tool with Splunk.
I have seen the Splunk Enterprise Security app which is similar to what we try to implement.
Is there any ideas on this ?

Tags (2)
0 Karma

chimbudp
Contributor

Thats cool. But , will i be getting the conf files and other property files ?

0 Karma

chris
Motivator

I think, that the easiest way to "integrate" a ticketing tool with Splunk ist to set up alerts and trigger a script that will create a ticket in your existing ticketing tool ( via whatever interface the tool offers).There is documentation here

The Enterprise Security app does have a workflow implemented to deal with the notable events(which are more or less incidents) that are created. Both of those are part of ES though and not available out of the box in a standard Splunk installation.

chris
Motivator

Oh, if you want to have ticketing information in Splunk it will depend on the ticketing tool and it's interfaces. If there is an interface that is exposed to the network (REST ... ) you might be able to get the information from a different machine than the ticketing server.

0 Karma

chimbudp
Contributor

Without installing forwarder , cant we achieve this?

0 Karma

chimbudp
Contributor

I need to set up a forwarder in the ticket tool server . there i need to configure the scripted inputs to get the ticket detials and populate in Splunk.
Problem here is Ticket Tool domain control is with another stream of business , where they provide access to install UF.

0 Karma

Ayn
Legend

Get the Enterprise Security app? 😃

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...