Hi,
I am relatively new to Google SecOps/SOAR.
The use case is to integrate SecOps SIEM with Splunk to enable the ability to have alerts triggered in SecOps to be forwarded to Splunk ( currently being used by the SOC ). Basically, as part of the operations migration, the requirement is to have the SOC receiving the alerts as the log sources continue to be migrated to Google SecOps.
I have had a look at the Splunk App under Response Integration ( Splunk Integration ) but based on my understanding, it looks to support curating or forwarding alerts from Splunk towards Google SecOps - instead of the other way round.
Please, anyone have an idea on how this use case can be achieved?
