Syncing Rumble Assets with Splunk


We are excited to announce the availability of an official Splunk Addon for Rumble!

Rumble Splunk Addon

This addon uses the new Asset Sync API included in version 1.3.1 of the platform and supports two modes of operation.

Rumble Splunk Addon Configuration

The New Assets Only mode will only pull in assets that have not been seen before, or could not be uniquely identified after being rescanned. The All Updated Assets mode will pull all changed assets since the last poll. The backend Asset Sync API is nearly identical to a standard asset export, including support for search filters, but allows checkpoints, where only data since a previous poll is returned.

If you want to sync only assets with a certain port or protocol open, using a filter like protocol:ftp can create a new Splunk input just for FTP servers. If you want to sync only assets found after a certain date, the created:2020-01-24:00:00:00 filter can be used to only return assets discovered after January 24th. Any asset search query can be applied to the input and multiple inputs can be used to feed various types of data into the Splunk backend.

Once the Rumble asset data is in Splunk, slicing and dicing it becomes a breeze.

MAC Address Vendors

If you prefer to build your own Splunk Addon using the Rumble API or would like help integrating Rumble data into a different backend, drop us a line!

Written by HD Moore

HD Moore is the co-founder and CEO of runZero. Previously, he founded the Metasploit Project and served as the main developer of the Metasploit Framework, which is the world's most widely used penetration testing framework.
More about HD Moore
Subscribe Now

Get the latest news and expert insights delivered in your inbox.

Welcome to the club! Your subscription to our newsletter is successful.

Related Articles

Product Release
Introducing the customizable dashboard, Wiz integration, and more!
Introducing the customizable dashboard, Wiz Integration, and other Q2 2024 enhancements to the runZero Platform.
Product Release
How to integrate your SIEM platform with runZero to create an actionable asset inventory
Learn how to combine runZero's real-time asset inventory with SIEM exports for comprehensive asset tracking and historical data analysis..
runZero Insights
Celebrating Women’s History Month with trailblazers & innovators
It’s Women’s History Month! runZero is celebrating all month long by highlighting innovative women who have been technological trailblazers.
Upcoming NYDFS regulatory requirements on asset inventory and vulnerability enumeration
Is your business prepared for the approaching deadlines for complying with the latest version of the NYDFS Cybersecurity Regulation (23 NYCRR 500)?...

See Results in Minutes

Get complete visibility into IT, OT, & IoT — without agents, credentials, or hardware.

© Copyright 2024 runZero, Inc. All Rights Reserved