Splunk SOAR App for CrowdSec. This App allows enrichment of IP addresses in an event investigation and playbooks with CrowdSec's CTI API.
This documentation will guide you through installing and configuring the app as well as showing an example of usage in which we'll show enrichement of IP addresses in an event investigation.
- Navigate to apps page from your dashboard as shown in the image below.
- Navigate to the new apps page by clicking on the
New Appsbutton. Then search for "CrowdSec"
- Click on the the Install Button to install the app.
Configurating the App
- Now the App should appear in the unconfigured apps.
CONFIGURE NEW ASSETbutton.
Enter the required details like asset name etc in the Asset Info tab.
- Navigate to Asset Setting pane, and enter your CrowdSec CTI API key. If you don't have one already see this guide to obtain one.
Click on the Save button to save the asset.
You can test this asset by clicking on the Test Connectivity button. If everything is configured properly, you would get message like the one in the image.
Done, you've successfully configured the app. You can now use it in your playbooks and event investigations.
Here's an example of it's usage in event investigation.