When the Splunk App for SOAR Export executes a Splunk search, which activities are completed?

When the Splunk App for SOAR Export executes a Splunk search, it typically involves mapping

Common Information Model (CIM) fields from Splunk to the Common Event Format (CEF) used by

SOAR, after which a container is created on the SOAR server to house the related artifacts and

information. This process allows for the integration of data between Splunk, which uses CIM for data

normalization, and Splunk SOAR, which uses CEF as its data format for incidents and events.

Splunk App for SOAR Export is responsible for sending data from your Splunk Enterprise or Splunk

Cloud instances to Splunk SOAR. The Splunk App for SOAR Export acts as a translation service

between the Splunk platform and Splunk SOAR by performing the following tasks:

•

Mapping fields from Splunk platform alerts, such as saved searches and data models, to CEF

fields.

•

Translating CIM fields from Splunk Enterprise Security (ES) notable events to CEF fields.

•

Forwarding events in CEF format to Splunk SOAR, which are stored as artifacts.

Therefore, option B is the correct answer, as it states the activities that are completed when the

Splunk App for SOAR Export executes a Splunk search. Option A is incorrect, because CEF fields are

not mapped to CIM fields, but the other way around. Option C is incorrect, because a container is not

created on the Splunk server, but on the SOAR server. Option D is incorrect, because a container is

not created on the Splunk server, but on the SOAR server.