Splunk Enterprise Event ingestion for Security Operation plugin COST

[AB6]

HI Community!

I want to install the Splunk Enterprise Event ingestion for Security Operation plugin, but i want to make sure that this plugin does not have cost

I saw that I can install in the production instance but...

Do you know if this plugin have cost?

I hope that you can help me to resolve this question

Regards.

[andy_ojha]

Hey there,

That specific ServiceNow Store App (and similar SIR/Security Incident Response alert ingestion, ServiceNow Store Apps). will have a dependency on being entitled to Security Incident Response (SIR).

In sub-production, you can install SIR and related apps w/ without the entitlement enforcement

- Store Apps, build/supported by a third-party (i.e. not ServiceNow), require a request/approval

- This app for Splunk Enterprise Event ingestion, is build by ServiceNow and does not require that for sub-production

In production, you can only install what you are entitled to.

If you are entitled to Security Incident Response (SIR) in Production, you can install SIR, and then install Splunk Enterprise Event Ingestion Store App in Production, as it is dependent on SIR.

There is no additional cost, for the Splunk integration/Store App itself, on-top the SIR entitlement.

Generally, always good to check in with your ServiceNow Account Team for clarification on what your are licensed for, and what your entitlements are.