Splunk SOAR

TrackMe integrates with Splunk SOAR in two directions. This page covers monitoring SOAR’s own health and pushing TrackMe events into SOAR. Driving TrackMe from SOAR is covered separately in TrackMe App on SOAR.

Monitoring SOAR health

You can monitor a Splunk SOAR deployment the same way you monitor anything else — with Flex Objects. A library of ready-made SOAR use cases covers asset health, automation-broker high availability, and infrastructure load (CPU, memory, services). Load a use case in a Flex-enabled tenant, adapt the SPL if needed, simulate, and create — TrackMe then tracks SOAR as tracked entities with the full state, scoring, and alerting model.

Pushing TrackMe events to SOAR

To drive SOAR playbooks from TrackMe, push TrackMe’s signals into SOAR:

  • Forward notable events (the recommended path) — TrackMe writes notable events to its notable index; the Splunk App for SOAR forwards them into SOAR as containers, where a playbook can act on them.

  • Push directly — the trackmesplksoar command builds a SOAR container from an entity’s context and posts it; it can be driven automatically from a stateful alert via the alert’s command delivery channel.

  • Enrich back — the trackmesplksoarlookup command pulls live SOAR object metadata (container, case, playbook, broker…) into a search, to decorate TrackMe entities with SOAR context.

Note

The push direction is one-way and on-demand — TrackMe does not poll SOAR on a schedule. Automate the enrichment lookup with a saved search if a dashboard must stay current, and spread large pushes (for example with | head) to avoid SOAR rate limits.

See also