Hello everyone, in this video, we'll be taking a look at the integration between Splunk and Cisco AI defense. We'll start with a brief introduction to Splunk, followed by the prerequisites required for integrating Cisco AI defense with Splunk.00:04Next, we'll explore the default Cisco AI defense dashboard and the insights it provides. Finally, we'll learn how to build a custom dashboard in Splunk to visualize the AI defense data most relevant to your organization.00:20Let's get started. Splunk is a platform used to collect index, search, analyze, and visualize machine generated data, especially logs from servers, applications, network devices, containers, and security tools. Systems are constantly generating information about what they are doing.00:31And when something goes wrong, that information is often the only way to understand what happened. So why is collecting data important? Let's look at a few practical examples of how security and operations teams use Splunk every day. Troubleshooting.00:51When users report blocked requests or unexpected AI behavior, Splunk helps quickly identify what happened when it happened and which policy was involved. The root cause, Splunk correlates events across AI applications and MCP interactions, helping teams understand why an action was blocked or monitored.01:07Security is another critical area where Splunk plays a vital role. Splunk provides visibility into AI specific threats such as prompt injection, jailbreak attempts, tool abuse, and suspicious user activity. When it comes to auditing and compliance, Splunk creates an audit trail of AI interactions, policy decisions.01:29And user actions to support governance and compliance requirements.01:49Trend analysis is also a significant advantage provided by Splunk. By analyzing usage patterns, policy trends, and emerging risks. Organizations can enhance their AI governance over time. This proactive approach helps in identifying and mitigating potential issues before they escalate.01:54Now that we understand why Splunk is valuable, let's look at the prerequisites needed for the integration so that events from AI defense can be forwarded successfully to Splunk. A valid Splunk account. An index in Splunk to store data sent by AI defense.02:12HTTP event collector enabled in Splunk. An event collector token in Splunk for AI defense. Now that we've reviewed the necessary Splunk configurations, let's log into the AI defense instance. This will allow us to proceed with setting up and managing the integration from the Cisco AI.02:32The defense side.02:52Within the AI defense dashboard, navigate to the administration section, then go to integrations and choose the others tab. Here, you'll find various integration options, including the card for Splunk. Locate the Splunk integration card and open its configuration page by clicking connect to begin the integration process.02:54On the Connect Splunk page, you will need to enter the requested information. These include the Splunk collector URL, the HTTP event collector token, and the index name. Once these fields are filled out, press the Connect button to finalize the connection.03:16With all details correctly inputted and the connection established, the status of the Splunk card will change to connected. This confirms that the integration process is complete and running correctly between Cisco AI Defense and Splunk. With the integration complete.03:32Let's explore the default Cisco AI defense dashboard and the insights it provides. The Cisco Security Cloud application provides visibility into AI activity, policy enforcement, guardrail triggers, and security events. Together.03:47These insights provide a centralized view of AI usage, sensitive data exposure, and application risk across the organization's AI environment. In this section, we focus on building a custom AI defense dashboard, introducing Splunk search processing language or SPL, which serves as a powerful query.04:03Language.04:23It allows users to search, filter, correlate, and visualize data effectively. With SPL, you can construct custom dashboards, generate insightful reports, and derive meaningful insights from AI defense events within Splunk. While the default dashboard provides valuable insights, organizations often want to visualize the data most relevant to their own.04:24Let's see how to build a custom dashboard. 1st, open the search and reporting app. Next, navigate to dashboards and select create new dashboard. When creating a new dashboard, provide a suitable name that reflects its purpose or content.04:44Choose the classic dashboard option for a traditional setup or a dashboard studio option. Once you're ready, click Create initiating the dashboard setup process. Once in the dashboard creation window, switch to source mode. Here, you can replace the example XML and SPL queries with your own customized code.05:04After you save the dashboard, you will have a fully customized AI defense dashboard tailored to your specific monitoring, security, and compliance requirements. As for the best practices for your AI defense and Splunk integration, you should focus on AI risk rather than raw event volume. Align your monitoring with recognized AI.05:25Security frameworks and prioritize trends and high risk activities that help improve your organization's security posture over time.05:45AI Defense and Splunk together provide visibility, detection, and protection against AI specific risks throughout the AI application life cycle. Thank you for watching, and I hope this overview helps you get started with your own AI defense and Splunk integrations.05:54
