Splunk Security Portfolio Setup

Prerequisites

Tool or access	Purpose	Verify
Bash and Python 3	Run bundled setup and validation helpers	bash --version && python3 --version
Required product/platform access	Inspect or configure the selected target	Complete the documented preflight
Credential files for live modes	Keep secrets out of chat	Verify paths only

Workflow Overview

┌───────────┐   ┌───────────────┐   ┌───────────────┐   ┌─────────────────┐
│ Preflight │ → │ Render/review │ → │ Apply/handoff │ → │ Validate evidence │
└───────────┘   └───────────────┘   └───────────────┘   └─────────────────┘

When to Activate

• A user asks for total Splunk security portfolio coverage, product gap analysis, or which Splunk security skill handles ES, ES 8.x native SOAR, Security AI Assistant / AI Assistant in Security, Federated Analytics, SOAR, Security.
• Preview and review the splunk security portfolio setup workflow before any live apply phase.
• Diagnose failed prerequisites, generated assets, configuration, or validation evidence.

Scope

Follow the documented read-only or render-first path whenever it is available. This skill does not imply permission to mutate live systems. Require explicit apply flags, protected credentials, and operator review for state changes.

Examples

Inspect the supported setup modes before selecting one:

bash skills/splunk-security-portfolio-setup/scripts/setup.sh --help

Expected output: usage, supported modes, and required arguments are displayed without changing the target environment.

Inspect validation modes before running completion checks:

bash skills/splunk-security-portfolio-setup/scripts/validate.sh --help

Expected output: offline, live, and completion options are displayed when the skill supports them; help exits without mutation.

Troubleshooting

Issue	Cause	Resolution
Preflight fails	A required tool or access path is missing	Resolve it before rendering or applying
Rendered assets are incomplete	Required non-secret inputs are absent	Complete intake and render again
Apply is blocked	Review, credentials, or explicit acceptance is missing	Use the documented handoff
Validation is incomplete	Live evidence is unavailable	Record the gap and keep completion open

Shared add-on completion gate

When the selected product resolves to a Splunk app, add-on, or dashboard companion, the owning child workflow must satisfy the shared completion gate. An install-only route is package delivery, not completed setup.

Use this skill as the security portfolio router before choosing a product specific setup skill.

What It Does

• Resolves a security product, capability, or related app name against the static security coverage catalog.
• Resolves exact normalized catalog keys, names, and aliases before considering fuzzy candidates; rejects low-confidence and tied fuzzy results.
• Classifies coverage as first_class, existing_skill, install_only, partial, bundled_es, or manual_gap.
• Routes first-class products to the product setup skills in this repo.
• Makes associated offerings explicit so a missing product is not hidden by generic app install coverage.
• Preserves legacy names such as Phantom, UBA, Mission Control, and ES while making current ES 8.x capability names resolve directly.

Primary Commands

List the coverage matrix:

bash skills/splunk-security-portfolio-setup/scripts/setup.sh --list-products

Resolve a product and preview the route:

bash skills/splunk-security-portfolio-setup/scripts/setup.sh \
  --product "Splunk Attack Analyzer" \
  --dry-run

Execute the resolved setup/install workflow:

bash skills/splunk-security-portfolio-setup/scripts/setup.sh \
  --product "Splunk Attack Analyzer" \
  --execute

Execution requires an exact, unique catalog key, product name, or alias. Fuzzy resolution is preview-only, even when --execute --dry-run is requested.

Preview the exact routed action without changing Splunk:

bash skills/splunk-security-portfolio-setup/scripts/setup.sh \
  --product "Splunk Attack Analyzer" \
  --execute \
  --dry-run \
  --json

Emit machine-readable coverage:

bash skills/splunk-security-portfolio-setup/scripts/setup.sh \
  --product "SOAR" \
  --dry-run \
  --json

Agent Behavior

• Prefer the resolved product skill for first_class and existing_skill results.
• Require an exact unique identity before --execute; return ranked candidates for low-confidence or ambiguous input instead of guessing.
• Keep ES Essentials / ES Premier edition routing distinct from the separate Splunk Security Essentials app.
• Use splunk-app-install for install_only apps unless a future product skill is added.
• Treat bundled_es results as Enterprise Security configuration scope.
• For ES 8.x native SOAR, route through ES configuration first, then use splunk-soar-setup for SOAR runtime, Cloud onboarding, Automation Broker, and Splunk-side SOAR apps.
• For Security AI Assistant / AI Assistant in Security, keep the ES configuration route authoritative and use splunk-ai-assistant-setup only for the generic Splunk_AI_Assistant_Cloud app workflow.
• For Federated Analytics, route the provider/index setup through the dedicated handoff-only aws_lake identity in splunk-federated-search-setup; never substitute generic aws_s3. Return to ES configuration for ASL, OCSF, ESCU, and detection-readiness handoffs.
• Treat manual_gap and partial results as handoff/readiness workflows and do not imply full automation.

Read reference.md when you need the full coverage table and source links.