Execute a Splunk search query and return the results.

Args: search_query: The search query to execute earliest_time: Start time for the search (default: 24 hours ago) latest_time: End time for the search (default: now) max_results: Maximum number of results to return (default: 100)

Returns: List of search results

Execute arbitrary SPL query (alias for search_splunk, for compatibility with label harvester).

Args: query: The SPL query to execute earliest_time: Start time for the search (default: 24 hours ago) latest_time: End time for the search (default: now) max_results: Maximum number of results to return (default: 100)

Returns: List of search results

Get a list of all available Splunk indexes.

Returns: Dictionary containing list of indexes

Get metadata for a specific Splunk index.

Args: index_name: Name of the index to get metadata for

Returns: Dictionary containing index metadata

List all saved searches in Splunk

Returns: List of saved searches with their names, descriptions, and search queries

Get information about the currently authenticated user.

This endpoint retrieves:

• Basic user information (username, real name, email)

• Assigned roles

• Default app settings

• User type

Returns: Dict[str, Any]: Dictionary containing user information

List all Splunk users (requires admin privileges)

Pivot on IP address across all indexes and sourcetypes for comprehensive analysis.

This is a critical tool for traditional SOC analyst workflows - it provides a complete view of all activity associated with an IP address, including network flows, authentication attempts, and data transfers.

Args: ip_address: IP address to pivot on (e.g., "10.1.42.42") timeframe: Splunk time modifier (e.g., "-30d", "-7d", "-1h") max_results: Maximum results to return per category

Returns: Comprehensive dictionary with all IP-related activity including: - Summary statistics (total events, unique destinations, time range) - Destination analysis (IPs contacted, ports, protocols) - Authentication events (users, success/failure, destinations) - Data transfer analysis (bytes in/out, top destinations) - Sourcetype distribution

Detect lateral movement patterns from a potentially compromised host.

Analyzes authentication attempts, rapid connections, privilege escalation indicators, and unusual protocols to identify lateral movement activity typical of advanced threats.

Args: source_ip: IP address of potentially compromised host time_window: Time window to analyze (default: "-7d") threshold: Minimum number of unique destinations to flag (default: 5)

Returns: Dictionary containing: - risk_score: 0-100 indicating likelihood of lateral movement - indicators: Boolean flags for various suspicious behaviors - timeline: Chronological list of authentication attempts - affected_hosts: List of systems that were contacted - recommendations: Suggested actions for analysts

Calculate data transfer volumes and detect potential exfiltration.

Analyzes outbound data transfers to identify large or suspicious uploads that may indicate data exfiltration, a common final stage in targeted attacks.

Args: source_ip: Source IP to analyze dest_ip: Optional specific destination IP (analyzes all destinations if not provided) timeframe: Time window to analyze (default: "-24h") threshold_mb: Threshold in MB to flag as suspicious (default: 100)

Returns: Dictionary containing: - summary: Total bytes/MB transferred with thresholds - top_destinations: Ranked list of destinations by upload volume - timeline: Chronological transfer events - risk_indicators: Flags for suspicious patterns

Build comprehensive attack timeline from multiple indicators.

Reconstructs a multi-stage attack by correlating events across different indicators (IPs, users, domains) to show the complete attack narrative.

Args: indicators: List of indicators, e.g. [{"type": "ip", "value": "10.1.42.42"}, {"type": "user", "value": "admin"}] timeframe: Time window to search (default: "-30d") correlation_window: Time window in seconds to correlate events (default: 7200 = 2 hours)

Returns: Dictionary containing: - summary: Attack overview with duration and stages - timeline: Chronological events with MITRE ATT&CK mapping - attack_chain: Events grouped by attack stage - recommendations: Remediation suggestions

Correlate DeepTempo finding with Splunk evidence for cross-platform analysis.

This is the key tool for AI-native investigation - it bridges DeepTempo's AI-detected anomalies with Splunk's comprehensive log data to provide complete attack context.

Args: finding_id: DeepTempo finding ID deeptempo_data: Finding data from DeepTempo MCP server containing: - src_ip: Source IP address - dest_ip: Destination IP address - timestamp: Finding timestamp - confidence: Detection confidence score - mitre_techniques: List of MITRE ATT&CK techniques timeframe_padding: Time padding around finding (default: "1h")

Returns: Dictionary containing: - finding_id: DeepTempo finding ID - deeptempo_confidence: Original confidence score - splunk_evidence: Related events from Splunk - enriched_context: Historical and related activity - similar_incidents: Other related findings - recommended_actions: Analyst recommendations

Discover field labels and schemas from Splunk indexes.

This tool harvests field names, types, sample values, and metadata from Splunk indexes to support DeepTempo training and evaluation. It can discover all fields or focus on CIM (Common Information Model) fields only.

Args: indexes: List of specific indexes to harvest (None = all indexes) focus_cim: If True, only return common CIM fields (src_ip, dest_ip, user, etc.) max_sample_events: Number of events to sample for field value examples timeframe: Time range to analyze for field discovery (e.g., "-24h", "-7d")

Returns: Dictionary containing: - harvest_timestamp: ISO-8601 timestamp of harvest - indexes_analyzed: List of indexes analyzed - total_fields_discovered: Total number of unique fields found - fields: Dictionary mapping field names to their metadata

Get detailed information about a specific field.

This tool provides deep analysis of a single field including value distribution, statistics, temporal information, and related fields that commonly appear together.

Args: field_name: Name of the field to analyze indexes: List of indexes to search (None = all indexes) timeframe: Time range to analyze (e.g., "-7d", "-30d")

Returns: Dictionary containing detailed field information: - field_name: The field name - type: Detected field type - total_unique_values: Count of unique values - top_values: Most common values with counts and percentages - first_seen: Earliest timestamp - last_seen: Latest timestamp - related_fields: Fields that commonly appear with this field - usage_by_sourcetype: Breakdown of usage by sourcetype

Export harvested field labels in DeepTempo-compatible format.

This tool transforms field label data from harvest_labels() into a format that DeepTempo can consume for training and evaluation. The format is designed to be generic and adaptable to DeepTempo's specific needs.

Args: field_data: Output from harvest_labels() containing field metadata output_format: Format version ("deeptempo_v1" for now) save_to_file: Whether to save the export to a file file_path: Path for output file (default: ./deeptempo_labels_export.json)

Returns: Dictionary containing: - export_data: The formatted data ready for DeepTempo - file_path: Path where file was saved (if save_to_file=True) - summary: Statistics about the export

Enrich an IP address with threat intelligence from multiple sources.

Queries free threat intelligence sources to provide context about IP addresses including reputation, geolocation, known malicious activity, and threat classifications.

Args: ip_address: IP address to enrich sources: List of sources to query (default: all available) Options: "abuseipdb", "alienvault", "threatfox", "internal"

Returns: Dictionary containing enrichment data from all sources: - reputation_score: 0-100 (100 = definitely malicious) - is_malicious: Boolean determination - threat_types: List of threat classifications - geolocation: Country, city, ISP information - last_seen: When this IP was last reported - reports_count: Number of abuse reports - confidence: Confidence score for the assessment

Check the reputation of an Indicator of Compromise (IOC).

Supports IPs, domains, file hashes, and URLs. Provides a quick reputation check with actionable intelligence.

Args: ioc_value: The IOC to check (IP, domain, hash, or URL) ioc_type: Type of IOC ("ip", "domain", "hash", "url", or "auto" to detect)

Returns: Dictionary containing: - ioc_value: The IOC that was checked - ioc_type: Detected or specified type - verdict: "malicious", "suspicious", "unknown", or "benign" - confidence: 0.0-1.0 confidence score - threat_categories: List of threat types - recommendations: Suggested actions

Add an IOC to Splunk's threat intelligence list.

Creates or updates a threat intelligence entry in Splunk that can be used for automated detection and correlation.

Args: ioc_value: The IOC to add (IP, domain, hash, etc.) ioc_type: Type of IOC ("ip", "domain", "hash", "url") threat_type: Classification ("malicious", "suspicious", "watchlist") description: Human-readable description of the threat expiration_days: Days until this IOC expires (0 = never)

Returns: Dictionary containing: - success: Boolean indicating if IOC was added - ioc_value: The IOC that was added - collection_name: KV store collection name - expires_at: Expiration timestamp

Get context and information about MITRE ATT&CK techniques and tactics.

Provides detailed information about attack techniques, tactics, and procedures to help analysts understand and categorize security findings.

Args: technique_id: MITRE ATT&CK technique ID (e.g., "T1071", "T1059.001") tactic: MITRE tactic name (e.g., "Command and Control", "Lateral Movement") search_term: Free-text search across techniques and descriptions

Returns: Dictionary containing: - techniques: List of matching techniques with details - tactics: Associated tactics - mitigations: Recommended mitigations - detections: Detection methods

Block an IP address by adding it to Splunk's firewall blocklist.

Creates a block entry that can be consumed by firewalls, proxies, or other security controls integrated with Splunk. The block can be temporary or permanent.

Args: ip_address: IP address to block duration_hours: How long to block (0 = permanent) reason: Reason for blocking (for audit trail) auto_unblock: Whether to automatically remove block after duration

Returns: Dictionary containing: - success: Boolean indicating if block was applied - ip_address: The blocked IP - blocked_until: Expiration timestamp - block_id: Unique identifier for this block

Isolate a compromised host from the network.

Quarantines a host by restricting its network access. This is typically implemented through network access control (NAC), endpoint security tools, or SDN/firewall rules.

Args: hostname: Hostname or IP to isolate isolation_level: "full" (complete isolation), "partial" (limited access), or "monitoring" (monitor only) reason: Reason for isolation duration_hours: Duration (0 = manual removal required)

Returns: Dictionary containing isolation status and details

Create an incident ticket in the ticketing system.

Auto-creates a ticket for tracking security incidents. Integrates with ITSM platforms like ServiceNow, Jira, or native Splunk incident management.

Args: title: Brief title of the incident description: Detailed description with evidence severity: "critical", "high", "medium", or "low" assignee: Username to assign ticket to (optional) tags: List of tags for categorization

Returns: Dictionary containing ticket details and tracking number

Send alert notifications to configured channels.

Pushes notifications to Slack, Microsoft Teams, PagerDuty, email, or SMS to ensure rapid response team awareness.

Args: message: Alert message to send channels: List of channels ("slack", "teams", "pagerduty", "email", "sms") severity: Alert severity level include_details: Whether to include full context in notification

Returns: Dictionary with delivery status for each channel

Detect statistical anomalies in time-series data.

Uses statistical methods to identify unusual patterns, spikes, or outliers in security data that may indicate threats.

Args: index: Splunk index to analyze field: Field to analyze for anomalies (e.g., "bytes_out", "auth_failures") timeframe: Time range for analysis sensitivity: "low", "medium", or "high" (affects threshold) method: Detection method ("statistical", "ml", or "baseline")

Returns: Dictionary containing: - anomalies: List of detected anomalous periods - baseline: Normal behavior metrics - confidence: Detection confidence score - recommendations: Suggested actions

Identify statistically rare events that may indicate threats.

Finds events, processes, domains, or patterns that occur very infrequently and may represent new attack techniques or zero-day exploits.

Args: index: Splunk index to analyze field: Field to analyze for rare values (e.g., "process_name", "domain") timeframe: Time range for baseline rarity_threshold: Percentage threshold for "rare" (0.01 = 1%)

Returns: Dictionary containing rare events and their frequencies

Learn and establish normal behavior baseline for a user, host, or service.

Creates a behavioral profile that can be used to detect deviations indicating compromise or insider threats.

Args: entity: Entity to profile (hostname, username, service name) entity_type: Type of entity ("host", "user", "service") timeframe: Time period to establish baseline metrics: List of metrics to baseline (default: common security metrics)

Returns: Dictionary containing behavioral baseline profile

List all KV store collections across apps.

Returns: List of KV store collections with metadata including app, fields, and accelerated fields

Get basic Splunk connection information and list available apps

Get a list of all indexes and their sourcetypes.

This endpoint performs a search to gather:

• All available indexes

• All sourcetypes within each index

• Event counts for each sourcetype

• Time range information

Returns: Dict[str, Any]: Dictionary containing: - indexes: List of all accessible indexes - sourcetypes: Dictionary mapping indexes to their sourcetypes - metadata: Additional information about the search

Get basic Splunk connection information and list available apps (same as health_check but for endpoint consistency)

Simple ping endpoint to check server availability and get basic server information.

This endpoint provides a lightweight way to:

• Verify the server is running and responsive

• Get basic server information including version and server time

• Check connectivity without making complex API calls

Returns: Dict[str, Any]: Dictionary containing status and basic server information