AlphaSOC Data Lake for Splunk
If you run AlphaSOC for Splunk, you can now query the AlphaSOC data lake directly from Splunk with the new | alphasoc generating search command.
AlphaSOC operates an OCSF data lake that stores the normalized telemetry and threat evidence collected across your environment: cloud infrastructure, SaaS applications, identity providers, and endpoint sources. The | alphasoc command runs a federated search from Splunk to that data lake, so you can investigate months of history from your Splunk search bar without ingesting and indexing it all locally. Queries are sent to the data lake for processing and results stream back into Splunk as they arrive.
The command starts a pipeline with one of three subcommands:
| alphasoc eventqueries the raw OCSF telemetry| alphasoc evidenceretrieves the flagged indicators AlphaSOC observed| alphasoc activityreturns evidence joined with the device and user behind it
Filter by class_name, log_source, device IPs, hostnames, DNS queries, and other OCSF fields, combine terms with AND / OR, then hand the results to the rest of your SPL pipeline for correlation and analysis.
Setup takes seconds: install AlphaSOC for Splunk from Splunkbase, then enter your AlphaSOC API URL and key on the app's settings page.