Splunk provides many methods to gain insight into data, and we strive to meet customers where they are. Now, users of Microsoft Security Copilot can interact with Splunk via a natural language AI interface. I recently had a chance to talk with Wayne Brown about the Splunk plugin and get a demo of how it works. Security Copilot takes natural language, transforms it into Splunk Search Processing Language (SPL), dispatches searches, and displays results while keeping session context.

Transcript

Auto-generated captions, lightly cleaned. Speakers are not separately labeled.

Hey everyone, we’re out here at Microsoft Tech Connect and Wayne, you showed me this really cool demo with Splunk and Security Copilot. Can you tell us what we’re doing there? Yeah, so we understand and we know that customers are starting to embrace Microsoft Security C-Pilot more and more as their point of entry for their day-to-day operations. And as Splunkers, we want to meet those customers where they are. So, we’ve built out a plugin for Security Copilot where a person using Copilot can go and access data from their Splunk installation and have it surface up in Microsoft Security Copilot. All right. So, they can use that security copilot as a a frontend and talk to their Splunk instance in natural language. Is that what we’re doing? Yeah, that’s exactly what I’m do what we’re doing here. Um, but rather than talk about it, why don’t I just show you what we’re doing? Awesome. Let’s do it. All right. So, we’re going to kick this off and we’ve built out a couple of different scenarios here where we’ve identified that these are probably the most you know usable scenarios that you know a C-pilot user would use C-Pilot to be able to access Splunk for. The first one is they’ve pre-built searches within Splunk and they want to run those searches that have been saved in Splunk to get that data surfaced up within Microsoft Copilot. So, we’re going to run that scenario now. So, using natural language, I’m going to come in and I’m going to ask uh Security Copilot to get all of the saved searches from Splunk for the C-pilot user. And at this point, Security Copilot is going to recognize the intent of what I just requested, and it’s going to use the Splunk plugin for Security Copilot to go and get a list of all of the save searches for the Copilot user within Splunk. And at this point, we have information about those searches that are coming up. uh it surfaces up a subset of information, but if you want to look at the fuller set, you can come in, click this button here, and you have a list of all of the searches that are being run. Now, the one that I’m interested in taking a look at here is our uh is our is our is our top MITER techniques. Um, so I want to run that save search and kick that search job off. So, I’m going to ask security copilot to run the save search. top MITER techniques. And the really cool thing about security copilot is it recognizes that I am still talking about the context of working and interfacing with Splunk. And by the nature of the request, it understands that I want to kick off this safe search. And we’ve integrated it via Splunk APIs so that now we’ve dispatched the safe search that we have saved in Splunk. And at this point the search job is kicked off and the next logical thing that we do is we you know get the search job results. Simple as that. You know we could talk to it in as natural language as possible and security copilot continues to understand that context. All of this information is maintained throughout the entire session and we know that we’re getting the search results back from that save search we just kicked off and we get this information surfaced up in a renderable format within SPL uh that comes back from Splunk and renders within security copilot. So you didn’t have to tell it go execute this job ID security copilot was just keeping up with that context as you continued your conversation. Correct. Just like you know you and I would have a conversation as we flow between topics you know there’s a common thread between each of the interactions that common thread is maintained all the way throughout. Awesome. And so when you’re interrogating Splunk this way with security co-pilot are you able to use other data sources to kind of stitch those together? Yeah absolutely. So I can take information such as if I’m doing research on a new technique that’s come out for a particular MITER attack or maybe a new CVE that just surfaced up, I can ask, you know, information from security copilot about the CVE and it can reference other sources such as public web or Microsoft documentation and then from there I can maintain that context and work with that within the context of Splunk. For example, I can kick off a ad hoc search or I can save that as a saved search within Splunk where I could then go in and refine it later to shape more to what I need. Awesome. So earlier you were talking about something called prompt books and I started to get an understanding on it, but can you tell us some more about what a prompt book is and how it’s used? Yeah. So, as you’re working with security copilot and working in, you know, natural language, sometimes you come across prompts or you you come up with prompts that are very consistent and the results that you want back. You can save those to be repeatable commands that you can execute at Hawk. And so as part of this project, we’re building out a couple of prompt books that will hopefully ship along with this plugin that a user who is familiar with uh SPL can go in and execute either a normal search or a oneshot search to, you know, get results back from Splunk. Cool. So here in this case, if we go to our prompts and we look at our prompt books, I have options here for a Splunk normal search and a Splunk oneshot search. And here I can just type in straight SPL. One of the neat things is we see the actual prompt that’s going to run here. And we also have the placeholder. And that and that placeholder is where we’re going to end up putting in and substituting in our SPL. So in this case, I’m going to run a really terrible search and I’m going to run it over the notable index and I’m going to look for system network configuration discovery. And so think of it as rather than co-pilot having to interpret the intent of a statement, we’re just coming in and executing the skill directly. So at this point, we have kicked off a oneshot search in Splunk. We’ve sent the command and now we’re starting to get back uh responses and data back from Splunk. So here at this point, we see the data that’s coming back in and we’ll see a subset of it. And once this is finished parsing out the data, we will see that how many results come back from this. And if we’re interested in seeing it, we can see that data is streaming in as copilot is receiving the data. And once that data is finished coming in, it lets us know how many results that we have returned from that particular SPL query. This is really cool stuff. Wayne, when can I go get my hands on this? If I said right now, would you be happy? I would be happy. So yes, this is available now. Uh this is available as a plugin within the Microsoft security copilot interface. Just look at it from your prompts but I’m sorry from your sources button and it’s there as an option for you to turn on. Once you turn it on, just configure it with your REST API URL and you can provide it a Splunk token to be able to hit that programmatic access. Awesome. Thanks, Wayne. Yeah, anytime. [Music]