Splunk® Intelligence Management (Legacy)

Welcome to Splunk Intelligence Management

Automate security operations using Splunk Intelligence Management

Use Splunk Intelligence Management to transform your intelligence to actionable automation across detection, triage, investigation, and dissemination use cases. The data-centric approach of Splunk Intelligence Management lets you to efficiently automate use-cases and reduce Mean-Time-to-Detection (MTTD) and Mean-Time-to-Response (MTTR).

While automating data-centric security, you are usually required to manage intelligence separately from the applications that you use to automate actions. However, Splunk Intelligence Management serves as the "reasoning layer" that lets you to manage the intelligence sources upstream from your applications and deliver on the promise of Security Orchestration, Automation, and Response (SOAR) tools.

The following figure explains how Splunk Intelligence Management can transform your intelligence to actionable automation using your existing SOAR tools:

This figure demonstrates Splunk Intelligence Management and its ability to transform intelligence

Splunk Intelligence Management provides maximum flexibility and integrates into your existing security environment using the following options:

  • Use the pre-built integrations in Splunk Intelligence Management with third-party tools and apps.
  • Build your own integrations using the REST API of Splunk Intelligence Management and Python SDK.
  • Leverage the standalone web app for searching and contextual lookups across all your sources.


How does the multilayered architecture of Splunk Intelligence Management work?

Use the multiple layers of Splunk Intelligence Management to collect, prepare, prioritize and connect all internal and external sources of intelligence to your security operations tools and use cases.

The following diagram explains the various layers that comprise Splunk Intelligence Management:

  • Data management and data processing: Focuses on core data operations, including collecting, managing, and processing the data.
  • Capabilities: Displays what you can do with your data.
  • Interfaces: Provides the options to leverage data across your tools and teams.
  • Use cases: Explains how to use Splunk Intelligence Management within your security operations.

This figure demonstrates  the multi-layer architecture of Splunk Intelligence Management

See also

Videos to get started with Splunk Intelligence Management

See the following videos to get started with Splunk Intelligence Management:

Last modified on 27 September, 2022
  Add intelligence to improve data quality using Splunk Intelligence Management

This documentation applies to the following versions of Splunk® Intelligence Management (Legacy): current


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters