https://github.com/techservicesillinois/secops-splunk-null-router
null router app for Splunk SOAR
https://github.com/techservicesillinois/secops-splunk-null-router
Last synced: 2 months ago
JSON representation
null router app for Splunk SOAR
- Host: GitHub
- URL: https://github.com/techservicesillinois/secops-splunk-null-router
- Owner: techservicesillinois
- License: other
- Created: 2022-04-21T16:34:03.000Z (about 4 years ago)
- Default Branch: main
- Last Pushed: 2026-03-03T20:21:32.000Z (3 months ago)
- Last Synced: 2026-03-03T20:47:44.587Z (3 months ago)
- Language: Python
- Size: 145 KB
- Stars: 3
- Watchers: 8
- Forks: 0
- Open Issues: 2
-
Metadata Files:
- Readme: README.md
- Changelog: CHANGELOG.md
- Contributing: CONTRIBUTING.md
- License: LICENSE
- Code of conduct: CODE_OF_CONDUCT.md
- Security: SECURITY.md
Awesome Lists containing this project
README
# About
Provides Splunk SOAR integration for the [NCSA BHR API][3] to null-route traffic from malicious domains.
Adds a playbook action called 'block' to Splunk SOAR playbooks.
Depends on [Python BHR Client][4]
[3]: https://github.com/ncsa/bhr-site
[4]: https://github.com/ncsa/bhr-client
## Support
This product is supported by Cybersecurity on a best-effort basis.
As of the last update to this README, the expected End-of-Life and End-of-Support dates of this product are October 2025.
End-of-Life was decided upon based on these dependencies:
- Python 3.9 (31 October 2025)
- Splunk SOAR Cloud (Unknown)
## Manual Deployment
Set the environment variables `SOAR_TOKEN` and `SOAR_URL`, then run `make deploy`.
## Automated Deployment
Alternately, fork the repository and add the token as `CICD_GITHUB_AUTOMATION` and the URL as `SOAR_URL` to use GitHub Actions for automated deployment.
## Configuring in SOAR
1. Create an API access token in your instance of [BHR Site][3].
2. [Deploy this app](#manual-deployment) to your Splunk SOAR instance.
3. After deployment, find the app in `Unconfigured Apps`, hit `Configure App`, and set the necessary `Environment Variables` under `Advanced`.
This app requires the same two environment variables as [BHR Client][4]:
- Add the full URL to your BHR server as `BHR_HOST`.
- Add the access token you created to `BHR_TOKEN`.