On the Splunk search head, when configuring the app to search SOAR searchable content, what are the two requirements to complete the app setup?

Question

Options

• AUser accounts and REST API.
• BUser accounts and syslog.
• CUser accounts and an HTTP Event Collector token.
• DUser accounts and universal forwarder.

• A
  89% (57)
• B
  6% (4)
• C
  3% (2)
• D
  2% (1)

Explanation

Option A is correct because Splunk SOAR exposes its searchable content through a REST API, and the Splunk app on the search head must authenticate to SOAR using user accounts (credentials) and communicate over the REST API to retrieve that content - these are the two setup requirements the app prompts for.

Why the distractors are wrong:

• B (syslog): Syslog is a log-forwarding protocol used to ship raw event data, not to query structured SOAR content from the search head.
• C (HEC token): An HTTP Event Collector token is used to send data into Splunk, not to pull data from SOAR.
• D (Universal Forwarder): A universal forwarder ships log files to Splunk indexers - it has no role in querying SOAR's internal data store.

Memory tip: Think "SOAR speaks REST" - you log in with a user account and query over the REST API, the same way you'd interact with any modern web service. HEC and forwarders push data to Splunk; REST pulls data from SOAR.

No community discussion yet for this question.