cascade-server
cascade-server copied to clipboard
mitre
Splunk and cascade
May i know what is app ? and how can i connect my splunk server to cascade?
Hi @sulaimanbale,
In the cascade-server code that interacts with Splunk, the app parameter is passed into the Splunk Python SDK: see https://docs.splunk.com/DocumentationStatic/PythonSDK/1.1/client.html it is described as:
app (string) – The app context of the namespace (optional).
If your Splunk deployment doesn't require defining an app, then you can leave this blank.
Hi, I have sysmon setup in splunk and how can I connect t it to cascade ?
What do I fill up for app configuration?
You can leave app configuration blank.
Cascade probably won't be able to see much from a default Splunk installation. I'm asking around to see if there's a released Splunk app / configuration that will work.