Red Hat Event Driven Ansible Add-on for Splunk

Description

The add-on provides custom alert actions to send Splunk events to Event Driven Ansible. Currently webhook, and Kafka methods are supported. Works with generic EDA event source plugins for webhook, kafka.

Documentation

Build

This add-on is built with Splunk's UCC Generator. Install ucc-gen per the instructions.

Consider using a python virtual environment: Getting Started with UCC Then, execute the following from the command line in the root of this repository to build the add-on:

ucc-gen build --ta-version=<version>

Example:

ucc-gen build --ta-version=1.0.0

The add-on will be built in an output directory in the root of the repository.

Package

ucc-gen package --path=./output/ansible_addon_for_splunk

Usage

Configuration

Configuration of a service account, depends on the type of connection, and desired authentication method. Currently webhook supports none, basic, or API key based authentication. Kafka supports none, SASL plaintext, or with SSL.

Sending one or more events can be done in a variety of ways within Splunk:

• Saved Search Alert Action
• Custom Command
• ITSI Episode Alert Action
• Enterprise Security Adaptive Response Action