Your SOC lives in Splunk. Dashboards, alerts, on-call runbooks, correlation searches: that's where your analysts already look. Security findings that live somewhere else are findings that get looked at later, or not at all.
This week we closed that gap. Two Mondoo apps are now live on Splunkbase:
- Mondoo Add-On (TA) for Splunk: the Technology Add-on that ingests Mondoo security and compliance data into Splunk
- Mondoo App for Splunk Enterprise: six prebuilt dashboards and ready-made alerts on top of that data
Both are open source under the Apache 2.0 license, and the full source code lives on GitHub: github.com/mondoohq/splunk-app.
Why two apps?
This split follows the standard Splunk packaging pattern: a Technology Add-on (TA) handles data collection and field extraction, and a separate app handles visualization. That separation matters in real deployments: in a distributed Splunk environment, the TA runs on a heavy forwarder while the dashboards install on your search heads. You collect once and search everywhere.
The TA: getting Mondoo data into Splunk
The Technology Add-on supports two collection paths, so you can pick the one that fits your environment.
REST API polling. A modular input polls the Mondoo GraphQL API on a configurable interval and indexes three sourcetypes:
| Sourcetype | What it contains |
|---|---|
mondoo:rest:audit | Audit trail of actions in your Mondoo space |
mondoo:rest:advisory | Security advisories |
mondoo:rest:agent | Registered Mondoo agents |
File-based ETL. For the heavier datasets, a file monitor ingests JSONL exports from the Mondoo ETL runner, with sourcetype routing handled automatically by filename:
| Sourcetype | What it contains |
|---|---|
mondoo:json:asset | Inventory of monitored assets |
mondoo:json:vuln | Known vulnerabilities across assets |
mondoo:json:check | Policy check findings |
mondoo:json:control | Security controls |
mondoo:json:package | Installed packages |
mondoo:json:query | Query results |
A few details we sweated so you don't have to:
- CIM mapping. Events map to the Splunk Common Information Model (the Vulnerabilities, Change, Inventory, and Alerts data models), so Mondoo findings plug into Enterprise Security correlation searches and any CIM-based content you already run.
- Checkpointed pagination. API collection resumes from where it left off after a restart, with automatic retry and exponential backoff. No duplicate events, no gaps.
- Credential hygiene. Bearer tokens and JWTs are scrubbed from the TA's own logs, so your Mondoo credentials never end up indexed in
_internal.
The app: six dashboards, ready on install
Indexing security findings is the easy half. The Mondoo App for Splunk Enterprise ships six prebuilt dashboards so the data is useful the moment it lands:
- Assets: your inventory with risk scores, platform breakdowns, and asset counts over time, with drilldown links back to the asset in the Mondoo console
- Vulnerabilities: CVE findings with severity, first-detected and resolved timestamps, and affected asset counts
- Checks: policy check results by severity and asset
- Queries: query result exploration
- Audit: who did what in your Mondoo space
- Data Information: indexing health, so you can see at a glance whether collection is flowing
The app also ships five saved searches, disabled by default so nothing fires until you decide it should:
- Critical open vulnerabilities by asset
- Stale assets (not seen in 7 days)
- Failed checks by severity
- Audit activity in the last 24 hours
- New critical CVE finding
Enable the ones that match your on-call reality, wire them to your notification channels, and you have Mondoo-driven alerting inside Splunk without writing a single SPL query.
One design decision worth calling out: the entire app resolves its index through a single macro. If your organization routes security data to a dedicated index, you change one macro definition and every dashboard and saved search follows.
Getting started
You'll need Splunk Enterprise 9.0 or later for the TA (the dashboard app is verified on 9.3 through 10.2) and a Mondoo service account.
- Install TA-mondoo where collection should run, on a single instance. On a distributed deployment that's a dedicated heavy forwarder; on a single-server setup it's simply your Splunk instance. Installing the TA on multiple instances creates duplicate events, so pick one.
- Configure the modular input with your Mondoo service account credentials, or point the file monitor at your ETL exports.
- Install mondoo_app on your search heads and open the Assets dashboard.
Detailed setup instructions, deployment topologies, and the data flow architecture are in the README on GitHub.
Open source, and open to feedback
Both apps are developed in the open at github.com/mondoohq/splunk-app. If something doesn't work in your environment, or there's a dashboard panel or sourcetype you're missing, open an issue or a pull request. This is a 1.0.0, and the roadmap is shaped by what Splunk-shop security teams actually need.
