Splunk + UAIO

Splunk Sees It. UAIO Kills It.

Point your Splunk alert actions at the iTechSmart UAIO API. Every SIEM alert gets classified at 94% confidence, remediated through governed workflows, and sealed with a Bitcoin-anchored proof-of-fix your SOC team can audit.

See How It WorksView Code
0.4s
Classification Time
94%
Confidence Score
0.6h
Mean Time to Remediate
SOC2
Audit-Ready Proof

Four Steps from SIEM Alert to SOC Proof

01

Splunk Alert Fires

A Splunk saved search, correlation rule, or Enterprise Security notable event triggers an alert. Your existing detections, dashboards, and risk-based alerting all work without changes.

02

Webhook Hits UAIO

The Splunk webhook alert action POSTs the full alert payload to the iTechSmart UAIO classify endpoint. Search results, severity, source type, and event metadata are all included.

03

Classify + Remediate

UAIO classifies the security incident in under 400ms at 94% confidence, identifies the root cause, and executes the matching remediation runbook. No analyst in the loop.

04

SOC Proof-of-Fix

Terminal output, log diffs, and before/after state are captured, hashed, and anchored to Bitcoin. Your SOC gets an immutable audit trail that satisfies SOC2, HIPAA, and FedRAMP requirements.

Splunk Alert
Webhook
Classify + Fix
SOC Proof

Webhook Configuration

Add this webhook alert action in Splunk under Settings → Alert Actions. Replace YOUR_ITECHSMART_API_KEY with your key from the UAIO dashboard.

JSON · Splunk Webhook
// Splunk Webhook Alert Action — sent to iTechSmart UAIO
// Configure at: Splunk > Settings > Alert Actions > Webhook
{
  "url": "https://api.itechsmart.dev/v1/classify",
  "headers": {
    "Authorization": "Bearer YOUR_ITECHSMART_API_KEY",
    "Content-Type": "application/json"
  },
  "payload": {
    "source": "splunk",
    "search_name": "$name$",
    "alert_severity": "$alert.severity$",
    "result_count": "$job.resultCount$",
    "search_query": "$search$",
    "trigger_time": "$trigger_time$",
    "results_link": "$results_link$",
    "result": {
      "host": "$result.host$",
      "source": "$result.source$",
      "sourcetype": "$result.sourcetype$",
      "raw": "$result._raw$"
    }
  }
}

UAIO Response

What comes back from the classify endpoint. Classification, remediation actions, and Bitcoin-anchored proof — all in under a second.

JSON · UAIO Response
# UAIO Response (0.4s):
{
  "classification": "brute_force_ssh",
  "confidence": 0.94,
  "root_cause": "Failed SSH attempts from 203.0.113.42 — 847 attempts in 5 minutes targeting root account",
  "remediation_summary": "Blocked IP via iptables, rotated SSH keys, disabled root login",
  "actions_taken": [
    "iptables -A INPUT -s 203.0.113.42 -j DROP",
    "Rotated authorized_keys for root and deploy users",
    "Set PermitRootLogin no in sshd_config",
    "Reloaded sshd service"
  ],
  "proof_of_fix": "https://proof.itechsmart.dev/fix/splunk-bf-9a2c",
  "bitcoin_anchor": "tx:3e8f1b..."
}

Frequently Asked Questions

Does this work with Splunk Enterprise Security (ES)?

Yes. Splunk ES notable events, risk-based alerts, and correlation searches all produce alert payloads that UAIO can classify and remediate. ES-specific fields like urgency, risk score, and asset/identity context are extracted and used to improve classification accuracy. If Splunk can fire a webhook, UAIO can handle it.

What types of security incidents can UAIO remediate?

UAIO handles infrastructure-level security incidents: brute force attacks, unauthorized access, service misconfigurations, certificate expirations, resource exhaustion from DDoS, and more. For incidents requiring human judgment — insider threats, data exfiltration investigations, policy decisions — UAIO escalates with full diagnostic context.

Is the audit trail SOC2 and HIPAA compliant?

The audit trail is built for it: SOC 2 Type II audit in progress (11 of 12 controls addressed) and HIPAA 100/100 within the HL7 module scope. Every remediation produces a proof-of-fix bundle: terminal output, log diffs, before/after system state, and a confidence score. The bundle is hashed and anchored to the Bitcoin blockchain, giving you an immutable, tamper-proof audit trail. Auditors can independently verify that every step happened exactly as recorded.

What if UAIO tries to remediate something risky?

UAIO runs with scoped permissions you define. You control which alert types, severity levels, and hosts UAIO can remediate. High-risk actions (firewall changes, service restarts, key rotations) can be gated behind approval workflows or limited to dry-run mode. Most SOC teams start with low-severity alerts and expand as they validate results.

Ready to Turn Splunk Alerts into Auto-Remediation?

Connect Splunk to iTechSmart UAIO and close the loop from detection to remediation. No agents to install, no code to deploy. Just a webhook and an API key.

Book a DemoAPI Docs