TrackMe App on SOAR

The TrackMe App on SOAR is a dedicated Splunk SOAR app that lets SOAR playbooks and analysts call into TrackMe — reading entity statuses and driving TrackMe features — so TrackMe becomes an actor inside your SOAR automation. It is the reverse direction of Splunk SOAR.

What it does

Each app action maps to a TrackMe REST API endpoint. Typical uses include:

  • retrieve the real-time status of TrackMe entities;

  • update an entity’s key behaviour parameters;

  • update acknowledgment status (for example, auto-acknowledge an entity from a remediation playbook);

  • interact with other TrackMe features, including the machine-learning capabilities and the AI advisors.

The app also ingests TrackMe alert events into SOAR natively: it polls TrackMe on a schedule and creates a container per notable or stateful alert event, de-duplicated on the event’s own identifier. This is the recommended way to bring TrackMe alerts into SOAR — it needs no forwarding rule, no report and no field mapping.

You configure a TrackMe asset in SOAR with credentials to the TrackMe API, and the app’s actions then become available to playbooks. With ingestion enabled, a single workflow can react to a TrackMe alert in SOAR and call back into TrackMe to act on it.

The app requires Splunk SOAR 7.0.0 or later and Python 3.13.

Note

The app ships with its own built-in documentation, and the exact action catalogue evolves with the app version — consult the in-SOAR documentation and the app’s README for the authoritative, current list of actions.

See also