> For the complete documentation index, see [llms.txt](https://docs.expel.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.expel.io/connect-your-technology/q-z-integrations/splunk/splunk-setup-for-workbench.md).
# Splunk Setup for Workbench
## Prerequisites
1. Expel needs access to the Splunk device or instance through port 8000 (UI) and 8089 (API). For cloud instances, follow the [Splunk Configure IP Allow List instructions](https://docs.splunk.com/Documentation/SplunkCloud/9.0.2205/Admin/ConfigureIPAllowList) to grant Expel these access privileges:
* Search head API access
* Search head UI access
2. Add [Expel's egress IP addresses](/workbench-setup/configure-an-ip-allow-list.md) to your IP allow list. All requests to rest API come from one of these IP addresses. *If you skip this step, this configuration only allows access to your Splunk environment from the Expel infrastructure.*
## Step 1: Enable Splunk Console Access
Expel requires console access to allow analysts to perform investigation and triage. Without this additional level of information, alerts cannot be verified by our analysts, and an investigation cannot be initiated. For more information, see [Why Expel Asks for Console Access](/connect-your-technology/about-integrations/why-expel-asks-for-console-access.md).
1. [Log into Splunk](https://login.splunk.com/).
2. Navigate to **Settings > Access Controls > Users**.
3. Select **Add new**.
4. Complete the fields:
* **Name** - enter "Expel".
* **Full name** - enter "Expel SOC".
* **Email address** - enter "soc+**\**@expel.io".
* For example, if your organization were Acme Corp, the format would be "".
* **Password** - provide a password.
* **Time Zone** - select **GMT** (or UTC).
* **Assign roles** - select **User**.
* **Require password change on first login** - clear this option.
5. Select **Save**.
6. **Before moving on to the next section**, make sure to give this newly created user permissions to view the `Notable` index and the `Notable` macro. If you need help completing this step, refer to the [Splunk documentation](https://docs.splunk.com/Documentation).
## Step 2: Retrieve and Provide a List of Indexes and Source Types
Providing Expel with a list of indexes and sourcetypes for your Splunk environment will allow us to query your data more efficiently.
1. From Spunk Home, select **Search & Reporting** in the Apps panel.
2. In the **Search** field, enter this string:
```
| tstats values(sourcetype) where index=* by index
```
3. Select the Search icon to return results.
4. In the toolbar beneath the search bar, choose an option to export the search results in PDF, Raw Events, or CSV format.
## Step 3: Add Splunk as a Security Device in Workbench
Now that you have the correct access configured and have noted the credentials, you can integrate your technology with Workbench.
1. [Log in to Workbench](https://workbench.expel.io/auth/login?orig=%2F).
2. In the side menu, navigate to **Organization Settings > Security Devices**.
3. Select **Add Security Device**.
4. In the search field, type “Splunk” and then select the **Splunk** integration.
5. If your installation is on premises (**On-prem**), then select the **Assembler** connected to the Splunk device. This is the assembler you set up in [Add a New Assembler](/connect-your-technology/expel-assembler/add-a-new-assembler.md). Otherwise, choose **Cloud**.
6. Complete the fields as follows:
* **Name** - enter a name that might help you more easily identify this integration, such as “CompanyName Splunk”; this name will display in Workbench under the Name column, and is a text string that you can filter on.
* **Location** - enter the location of your integration, for example, “cloud.” This is also a text string that you can filter on, so we recommend being consistent with location naming across your Expel integrations.
* **Username** - enter the username for the user you created in [Step 1](#h_01j421380c184fa0mcm0rex26z).
* **Password** - enter the password you created in [Step 1](#h_01j421380c184fa0mcm0rex26z).
{% hint style="info" %}
Expel manages Basic authentication by passing the Splunk username and password combination in an API request. The following code snippet shows how these values are passed:
```
import splunklib.client as client
service = client.connect(host=, username=, password=, autologin=True)
```
Expel also supports Splunk API tokens for non-Basic authentication support, which you can create using Splunk documentation.
{% endhint %}
* **Splunk Enterprise Security instance?** - leave this blank.
{% hint style="info" %}
Splunk Enterprise Security alerts require review by Expel before enabling. [Contact Expel support](/support/how-to-reach-us.md) for details.
{% endhint %}
* **Server address**:
* **Cloud** - enter the Splunk server address and port 8089. For example: `https://.splunkcloud.com:8089`
* **On-prem** - enter the Splunk console IP address and port 8089. For example: `https://10.10.10.10:8089/`
7. Select **Save**.
8. On the console access screen, select **Set up now**.
9. In the Console Login area, enter these details:
* **Console URL**
* For **cloud**, enter the Splunk server address and port. For example, `https://splunkcloud.com:8089`
* For **on-prem**, enter the Splunk console IP address and port. For example, `https://10.10.10.10:8089/` .
* **Username** - enter the username for the user you created in [Step 1](#h_01j421380c184fa0mcm0rex26z).
* **Password** - enter the password you created [Step 1](#h_01j421380c184fa0mcm0rex26z).
* **Two-factor secret key (32-character code**): depending on how your organization enforces logins, this field may not apply to you. In these cases, you can leave it blank. This field is optional and if you have questions or concerns, [contact support](/support/how-to-reach-us.md).
10. Select **Save**.
Your device should be created successfully within a few seconds. A few reminders:
* After your connection is healthy, it will take some time for your device to begin polling and receiving data.
* To check on the status, select the downward arrow for your device in the first column and choose **View details**.
* Polling will happen first; data will be received after that. **You must refresh the page to see updates.**
* If your device does not begin polling within 15 minutes, and does not begin receiving data within 30 minutes, [contact our support team for help](/support/how-to-reach-us.md).
* To check if alerts are coming through, navigate to **Dashboards > Alert Analysis**. Scroll to the device you want to check, and select the **Expel Alerts** tab to reveal more alert information. It can take 36 to 72 hours for alerts to appear after setup, as we [tune your device](/workbench-reference/alerts/how-expel-alerts-work.md#device-tuning).
## Additional Criteria for Support
The actions below improve our ability to normalize custom alerts so they are properly presented in Workbench. They also equip our analysts with necessary context so they can make informed decisions.
**CIM Compliance**\
To properly display alert evidence in Workbench, fields must be normalized according to Splunk's Common Information Model. Expel only uses a portion of the 500 CIM fields available for alert normalization. Expel uses version 6 of CIM Compliance.
Proper normalization also enables Ruxie to perform automated actions on the alert. We rely on proper normalization to create detections, suppressions, bloom for detections (alert deduplication), BOLOs, and in-depth DUET messages. If a CIM field isn't being used and is requested to be a part of alert normalization or DUET messages, then we typically can't support the request.
Please review the fields being returned from Splunk searches to ensure they map to what is shown in [Splunk's Common Information Model Add-on Manual](https://help.splunk.com/en/splunk-cloud-platform/common-information-model/6.1/data-models/cim-fields-per-associated-data-model).
**Use the Description Field**\
Any additional information about the custom rule that may be useful for our analysts should be included in the Description. Examples include the detection’s intent and suggested steps to triage.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.expel.io/connect-your-technology/q-z-integrations/splunk/splunk-setup-for-workbench.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.