Skip to main content
Connect your Splunk search head (Enterprise or Cloud) so Myrmex can run SPL searches, triage Enterprise Security notable events, and browse your search catalog. Myrmex reaches Splunk over HTTPS on the management port (default 8089) through a Collector on your network. Every search runs live, on demand — Myrmex returns only what you ask for at that moment and copies or stores nothing from Splunk on its side. Credentials are resolved on your side and never pass through the model.

​
What Myrmex Can Do

Run SPL searches

Execute one-shot SPL live, with a guard that blocks destructive commands.

Triage notable events

List, read, and update Enterprise Security notables to support alert triage.

Browse the search catalog

Read the saved and correlation search catalog to understand your detections.

Enrich notables

Run one-shot enrichment on a notable to pull the context around it.

​
Before You Start

  • A Collector that can reach the Splunk management/REST port (default 8089, HTTPS). On-prem it sits on the LAN; Splunk Cloud requires REST access (IP allow-list on port 8089). See Collector mode.
  • A role that can search the relevant indexes. For notable triage and updates it needs the Enterprise Security ess_analyst role (capability edit_notable_events). Do not grant can_delete.
  • For token auth: Token Authentication enabled (it is off by default on Splunk Enterprise).

​
Step 1 — Create the Credential in Splunk

1

Option A — mint an authentication token (recommended)

Token authentication is disabled by default on Splunk Enterprise. In Settings → Tokens, enable Token Authentication, then create a token for the service account. Copy the JWT (it starts with eyJ). Use the REST auth token — not an HEC token (which is a UUID).
2

Option B — use a service account (Basic)

Basic auth works with no server change. Create a Splunk user with a role that can search the relevant indexes, then set Authentication Method to basic and provide the username and password.
3

Grant the right role

The account (or the token’s user) needs to search your indexes. For Enterprise Security notable triage and updates, assign the ess_analyst role. Do not grant can_delete.
Prefer the JWT token method and least privilege. Keep the role scoped to the indexes Myrmex needs, plus ess_analyst only if you use notable triage.

​
Step 2 — Add the Integration in Myrmex

From the Directory, choose Add Integration → Splunk, then fill in:

​
Connect

Click Connect to validate the REST connection and finish. Splunk then appears under Environment → Integrations, and you can ask about it in the Workspace or through the Integration Specialist agent.
Leave the token blank and set the method to basic to use username and password. If you use Enterprise Security in a custom app, update the Enterprise Security App field so the notable macro resolves.