Splunk

In obserae: create a Splunk HEC output. The add-on below is search-time only — it maps what already arrived onto Splunk’s data models.

The output

Connectors → Outputs → + New output, type Splunk HEC: your HEC base URL, the token, and optionally an index. obserae proposes the sourcetype matching the event schema you chose and never imposes it on an existing output.

You can send obserae’s own document (obserae:alert) or an OCSF Detection Finding (obserae:alert:ocsf). Pick one and keep it: a Splunk index already holding one shape does not want the other appearing halfway through, because your saved searches are written against the field names that are in there now.

The add-on

TA-obserae maps alerts onto the CIM Alerts and Network Traffic models so the dashboards and correlation searches Splunk already ships light up.

Search-head only. It contains no inputs, no scripts and no credentials — only search-time extractions, so nothing on your indexers changes and there is nothing in it that can talk to obserae.

Install it from Splunkbase (TA-obserae), or from the file if your search head has no internet access: download the add-on, then Apps → Manage Apps → Install app from file. The add-on’s own README covers verification and the field-by-field mapping.

Writing into a SIEM is not integrating with it: an index full of obserae’s own field names supports no dashboard and no correlation. That is what this add-on is for.