icon/x Created with Sketch.

Splunk Cookie Policy

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website. Learn more (including how to update your settings) here.
Accept Cookie Policy

We are working on something new...

A Fresh New Splunkbase
We are designing a New Splunkbase to improve search and discoverability of apps. Check out our new and improved features like Categories and Collections. New Splunkbase is currently in preview mode, as it is under active development. We welcome you to navigate New Splunkbase and give us feedback.

Accept License Agreements

This app is provided by a third party and your right to use the app is in accordance with the license provided by that third-party licensor. Splunk is not responsible for any third-party apps and does not provide any warranty or support. If you have any questions, complaints or claims with respect to this app, please contact the licensor directly.

Thank You

Downloading OT Security Add-on for Splunk
SHA256 checksum (ot-security-add-on-for-splunk_233.tgz) 78ddad09fcee9c18b5b8ef00aa6ef9d2a6d7769ac6f0b9f7dca458aff3812f1a SHA256 checksum (ot-security-add-on-for-splunk_231.tgz) 7413d49a561a0cf8137434ba48a438f648ba7fb523b113e88a155af2031966f4 SHA256 checksum (ot-security-add-on-for-splunk_220.tgz) 980376ad2f9617b1c6584160da0d9a0768272e13926292446925e401a21b4056 SHA256 checksum (ot-security-add-on-for-splunk_211.tgz) 21ad9ceb91806fee95169382d5ee69443ad179008eb4fbff6d7feb4fd2d98c74 SHA256 checksum (ot-security-add-on-for-splunk_202.tgz) a0a7df88a96006a5937ef07e67d2ffa1f20834d7f2018c3d34c96cf50292f389 SHA256 checksum (ot-security-add-on-for-splunk_201.tgz) 4d56d262e6064446d84b62bebaf20964a7d35029af58a0506891a29482c81ab7 SHA256 checksum (ot-security-add-on-for-splunk_104.tgz) 71cdbe9debaabed8925401fc31a5d577aebabda99a328744447bd70215152b96
To install your download
For instructions specific to your download, click the Details tab after closing this window.

Flag As Inappropriate


OT Security Add-on for Splunk

Splunk Cloud
Splunk Labs
This app is NOT supported by Splunk. Please read about what that means for you here.
The OT Security Add-on for Splunk enables organizations that operate assets, networks, and facilities across both IT and OT environments to better apply the globally proven SIEM, Splunk Enterprise Security, to improve threat detection, incident investigation, and response. The OT Security Add-on for Splunk expands the capabilities of Splunk’s platform to monitor for threats and attacks, compliance, incident investigation, forensics, and incident response across the broad spectrum of assets and topologies - from email servers to PLCs - that define modern manufacturing, energy, and public sector organizations.

Components of this solution include:
OT Security Overview
Perimeter Monitoring
Infrastructure Monitoring
Centralized view across partner technologies.
NERC CIP Compliance Reporting
Correlation Rules including mapping to security frameworks like MITRE ATT&CK for ICS, CIS 20, and others
Integration with Enterprise Security
Dashboards designed to help you identify misconfigurations and missing data

The OT Security Add-on for Splunk REQUIRES Splunk Enterprise Security.

For any OT related sales conversations, please contact otsecurity@splunk.com

The Splunk for OT Security app requires Splunk Enterprise Security.

This app utilizes the Common Information Model app and ES's Asset and Identify Framework to identify specific threats to the OT environment. In addition, it utilizes two included data models for extended asset info including hardware and software and integration with partner technologies.

Components of this solution include:

  • OT Centric View of Assets: Overiews, Asset Views, Perimeter & Infrastructure Monitoring
  • NERC CIP Compliance Dashboards and Reports: CIP 002,004,005,006,007,008,009,010
  • Correlation Rules (including MITRE ATT&CK for ICS): Prebuilt correlations searches for detections specific to the OT environment (e.g. Internet activity inside OT environment)
  • Key Security Indicators: Prebuilt KPI's for Security related to OT Security
  • Baselining: Build configuration baselines for hosts interactively within Splunk
  • Analytics Stories: View related content based on specific scenarios and use cases
  • Integration with Enterprise Security including features like [Risk Based Alerting (RBA)](https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Implementing_risk-based_alerting)

Full documentation on the OT Security Add-on for Splunk can be found below (including how to install and configure the Add-on):

Release Notes

Version 2.3.3
Feb. 7, 2024

Update for missing metadata folder preventing the nav menu from showing

Version 2.3.1
Dec. 1, 2023

Added Baseline Templating
Add Data Source Integration Dashboard to help identify gaps in data or mis-configurations
Added UDF Dashboard of XML Dashboards

Version 2.2.0
March 6, 2023

The latest edition adds several key features to help you move beyond the perimeter and beyond monitoring your OT Infrastructure as well as great integration with security frameworks. Specifically this update includes:

  1. Native integration with MITRE ATT&CK for ICS and built in mappings to CIS 20, MITRE ATT&CK, NIST, and Kill Chain)
  2. Content added for OT Infrastructure Monitoring and centralized view for OT Security Solutions
  3. Additional Risk Based Alerting Integration
  4. Baselining Assets Configurations with new GUI
  5. Use case library analytic stories
  6. Additional features to customize asset names and assets that are part of the OT Environment
  7. Various fixes and improvements
Version 2.1.1
Jan. 4, 2022

4 Additional Dashboards focused around Perimeter Security (Monitoring, Auditing, Remote Access, and Traffic Analysis)
5 Additional Reports focused around Perimeter Security
10+ Additional KSI searches
5 Additional Correlation Searches
Added integration with Vulnerabilities Data Model
Added various macros to allow easier customization of dashboards and content
Added lookup to standardize asset types and their name customizable to products and user environment
Added asset and user filters to NERC CIP content dashboards
Added dashboard content around logical ports and services
Added additional documentation on integrating partner technologies into the OT Security Add-on
Updates of MITRE ATT&CK for ICS correlation searches for more improved integration
Updates to Enterprise Security 6.6 for new ES features like Risk Based Alerting
Fixed issue with Operational Security navigation menu missing

Version 2.0.2
March 16, 2021

Site and System Filtering Added for OT Security dashboards
4 new MITRE ICS Rules detections added
Additional rules for integration with 3rd Party OT Security Solutions
Review and update of existing correlation rules
CIP 006 Dashboards and Reporting Added
CIP 007 Dashboards and Reporting Added
CIP 008 Dashboards and Reporting Added
CIP 009 Dashboards and Reporting Added
Added Splunk Cloud compatibility

Version 2.0.1
Feb. 9, 2021

Site and System Filtering Added for OT Security dashboards
4 new MITRE ICS Rules detections added
Additional rules for integration with 3rd Party OT Security Solutions
Review and update of existing correlation rules
CIP 006 Dashboards and Reporting Added
CIP 007 Dashboards and Reporting Added
CIP 008 Dashboards and Reporting Added
CIP 009 Dashboards and Reporting Added

Version 1.0.4
Oct. 20, 2020

Added Dashboard - OT Controls : Network North South Traffic Analysis
Added Dashboard - OT Controls : Network & System Access
Added NERC CIP 004 Dashboards
Incremental updates on existing dashboards and correlation searches

Subscribe Share

Are you a developer?

As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.

Follow Us:
Splunk, Splunk>,Turn Data Into Doing, Data-to-Everything, and D2E are trademarks or registered trademarks of Splunk Inc. in the United States and other countries. All other brand names,product names,or trademarks belong to their respective owners.