01
Continuous audit evidence
Logging and monitoring controls (ISO 27001 A.8.15, A.8.16, SOC 2 CC7) are proven by Splunk data, with no screenshots or manual exports.
×
Splunk connector
From security signals to board-level decisions.
Splunk sees everything that happens across your environment. Domyno turns it into governance: up-to-date risks, continuously proven compliance, tracked actions and executive reporting.
One Splunk alert, six governed outcomes
Illustrative scenario: each step triggers automatically, a human validates.
Splunk · correlated alert
Brute force on admin accounts
47 failures · 3 accounts · 6 min
notable · urgency: high- src
- 185.220.101.4
- user
- adm-jdupont
- dest
- AD-PROD-01
- risk_score
- 80
Asset and owner
Domain controller AD-PROD-01 · owner: CIO
Risk recalculated
Privileged identity compromise: 9 → 14 / 25
Controls impacted
ISO 27001 A.8.16 · NIS2 Art. 21 · DORA ICT incident
Remediation action
Enforce MFA on admin accounts · assigned · D+7
Executive dashboard
“Detect” maturity and exposure updated
Back into Splunk (HEC)
sourcetype=domyno:governance · action, decision, due date
Illustrative example
Splunk alone
- Thousands of events, read by the SOC
- Audit evidence compiled by hand in Excel
- Risks reviewed once a year
- Leadership sees alerts, not business stakes
Splunk + Domyno
- Relevant signals linked to assets and risks
- Logging and monitoring evidence collected continuously
- Risk likelihood adjusted by real data
- Clear executive reporting: exposure, compliance, actions
Four concrete use cases
02
NIS2 / DORA incident reporting
A major incident becomes a structured file: timeline, affected assets, impact, ready for the 24 h and 72 h deadlines.
03
Data-driven risk
Risk likelihood moves with what Splunk observes. The register stays alive instead of being reviewed once a year.
04
Detection coverage
Domyno matches the asset inventory against Splunk sources and shows which critical assets send no logs.
Why it matters for Splunk
More value, higher up
Splunk data also serves the CISO, risk, compliance and the executive committee.
Splunk at the heart of governance
Splunk becomes the evidence source for compliance, and harder to replace.
A joint offer
For Splunk partners and customers: detection and governance in one approach.
How it works
Read-only access
Through the Splunk REST API and saved searches. Nothing is written to Splunk.
No raw log copies
Domyno only retrieves the indicators that matter for governance.
Hosted where you want
Your cloud of choice, any region, or on premises.
Under the hood
Target integration architecture
Splunk brings the signals, Domyno governs them, and can send its decisions back into Splunk.
Cloud / Enterprise
- Indexes → saved searches
- Notables (Enterprise Security)
- Risk-Based Alerting
- Asset & Identity lookups
- HEC (optional)
→ signals← HEC
Domyno- Read-only connector
- CIM field normalization
- Asset / risk / control mapping
- Inventory sync
- Governance events
Risk register · Compliance · Executive dashboard
Concrete SPL queries
Indicative examples, adapted to your environment.
SPL · Detection coverage
| tstats count latest(_time) as last_seen where index=* by host
| eval silent_h=round((now()-last_seen)/3600,1)
| where silent_h > 24What Domyno does with it
Matched against the Domyno inventory: silent critical assets surface as an A.8.16 control gap.
Mapping to Splunk standards
| CIM data model | Domyno module | Controls |
|---|---|---|
| Authentication | Assets & access | ISO A.8.5 · NIS2 Art. 21 (i) · DORA Art. 9 |
| Change | Documentation & compliance | ISO A.8.32 · DORA Art. 9 |
| Network Traffic | Risk analysis | ISO A.8.20 · NIS2 Art. 21 (e) |
| Vulnerabilities | Risk analysis | ISO A.8.8 · NIS2 Art. 21 (e) · DORA Art. 8 |
| Endpoint | Assets & access | ISO A.8.1 · A.8.7 |
Integration specifications
Authentication
Authentication token, dedicated read-only role, srchIndexesAllowed limited to the relevant indexes.
Calls
REST API (port 8089), saved searches through /services/search/jobs, scheduled (e.g. 15 min) or triggered by an alert action.
Compatibility
Splunk Cloud Platform and Splunk Enterprise 9.x. Enterprise Security and SOAR optional.
Data
Aggregated results and metadata only, no raw events. Every call is logged.
Deployment
SaaS in the region of your choice, or on premises next to Splunk.
FAQ
Does Domyno replace Splunk or a SIEM?
No. Splunk detects and investigates. Domyno builds on that data to govern risk, compliance and decisions.
Are Splunk Cloud and Splunk Enterprise supported?
Yes, both, through the Splunk REST API, including on-premises Splunk Enterprise.
Do we need new detection rules?
No. Domyno reuses your existing alerts and searches, and can suggest new ones to close gaps.
How long to get started?
Connecting takes a few hours with a read-only service account; the rest is configured with our experts.
What about license and search load?
No extra ingestion from Domyno. Searches are scheduled, time-bounded and favour tstats on accelerated data models.
Is there a Splunkbase app?
Not today: the integration uses the REST API. A Splunkbase app is a possible next step.
Multiple search heads or Splunk instances?
Yes, each instance is declared as a separate source and attached to the right scope.
Let's see what Domyno does with your Splunk data
30 minutes with a co-founder, on your own context.
Book a meeting