Use adaptive response relay to send notable events from Splunk ES to Splunk SOAR

Adaptive response relay allows adaptive response actions to queue on a heavy forwarder before they sent to Splunk SOAR. For example, you can use adaptive response relay to schedule a time when resources are more available to send notable events from Splunk Enterprise Security (ES) or Splunk Cloud Platform to Splunk SOAR.

If you do not need to send events with a heavy forwarder, use adaptive response actions. See Run adaptive response actions in Splunk ES to send notable events to Splunk SOAR.

How adaptive response relay sends notable events from Splunk ES to Splunk SOAR

The search head receives the Splunk SOAR information and playbooks from the heavy forwarder. The heavy forwarder receives the adaptive response actions from the search head.

To get started, perform the following tasks:

1. On the search head where you already have Splunk ES and the Splunk App for SOAR Export installed
   1. Obtain and install the Lookup File Editor on Splunkbase.
   2. In the Lookup File Editor app, click on cam_workers.csv and verify that the worker set is hf1 and cam_workers is set to ["hf1"]. Change the value accordingly if they are not.
2. Install a Splunk heavy forwarder. On the heavy forwarder:
   1. Install Splunk ES and the Splunk App for SOAR Export (this add-on).
   2. You can rename the heavy forwarder server. An example name is hf1.

Set up adaptive response relay on your Splunk instances

Configure the heavy forwarder and search head to be able to exchange data with each other.

1. On the search head, go to https://<yoursplunkserver>/en-US/splunkd/__raw/alerts/modaction_queue/key and record the API key.
2. On the search head, follow the instructions in Configure your Splunk Cloud Platform ES search head with an API key in the Administer Splunk Enterprise Security manual.
3. On the heavy forwarder, follow the instructions in Configure your on-premises heavy forwarded with an API key in the Administer Splunk Enterprise Security manual.
4. If you are using Splunk Enterprise, perform the following steps to set up forwarding from the heavy forwarder to Splunk Enterprise. If you are using Splunk Cloud Platform, follow the instructions in How to forward data to Splunk Cloud Platform in the Splunk Universal Forwarder Forwarder Manual to set up forwarding from the heavy forwarder to Splunk Cloud Platform.
   1. On the indexer, set up the receiving port:
      1. In Splunk Web, go to Settings > Forwarding and receiving.
      2. In the Receive data section, click + Add new.
      3. Enter 9997 in the Listen on this port field to set up port 9997 as the receiving port.
      4. Click Save.
   2. On the heavy forwarder, set up forwarding to the indexers:
      1. In Splunk Web, go to Settings > Forwarding and receiving.
      2. In the Configure forwarding section, click + Add new.
      3. In the Host field, enter the IP address and port number (9997) of the indexer. For example:

         192.168.11.12:9997

      4. Click Save.
5. On the heavy forwarder, follow the instructions in Configure your on-premises heavy forwarder with a modular action relay in the Administer Splunk Enterprise Security manual to set up a modular action relay.
6. On the search head, follow the instructions in Configure your Splunk Cloud Platform ES search head with a modular action worker in the Administer Splunk Enterprise Security manual to set up the Lookup File Editor and add a cam_worker.
7. On the search head, add an alert action configuration in the Splunk App for SOAR Export.
   1. Navigate to the Splunk App for SOAR Export.
   2. Select the Configurations tab.
   3. Select and expand the ES Adaptive Response Relay Configuration section.
   4. Select Add Alert Action Configuration to create a new configuration.
   5. Give the configuration a name, and specify the credentials to the heavy forwarder. These credentials are required to retrieve Splunk SOAR configuration information.
   6. Select Save.

Synchronize adaptive response relay data between the heavy forwarder and search head

Perform the following tasks so that data between the Splunk instances is synchronized.

1. Perform the following tasks on the heavy forwarder:
   1. Navigate to the Splunk App for SOAR Export.
   2. Click the Configurations tab.
   3. In the ES - Adaptive Response Relay section, click Push Relay Data (on HF). This causes the heavy forwarder to read the phantom.conf file and obtain the server configs that are marked for adaptive response relay and playbook configurations and push this data to the search head. Any events containing the corresponding data are also pushed to the search head. See Connect the Splunk App for SOAR Export and the Splunk Platform to a Splunk SOAR server for information about how to mark a server to be used for adaptive response relay.
2. Perform the following tasks on the search head:
   1. Navigate to the Splunk App for SOAR Export.
   2. Click the Configurations tab.
   3. In the ES Adaptive Response - Relay section, click Poll Relay Data (on SH). This causes the search head to run the following search and obtain the server configurations and playbooks:

      index=main source=*/var/log/splunk/phantom_ar_relay.log

Only the most recent 1,000 playbooks can be obtained using adaptive response relay.