Threat Intelligence

SOCRadar Brings Multi-Company Alarms and Vulnerability Findings Into Splunk

SOCRadar · 15 Oct 2026

Key Takeaway If you rely on a managed security provider, ask how they keep each customer's data separate and how external risk findings reach the tools their analysts use every day.

SOCRadar has released two new apps on Splunkbase: SOCRadar Incidents MSSP and SOCRadar Vulnerability. The aim is to let security analysts see external risk inside Splunk, rather than switching between separate consoles, inputs and spreadsheets of known software flaws.

SOCRadar Incidents MSSP is built for managed security service providers and enterprises with many subsidiaries. A single input, set up with a Multitenant API Key and Multi-Tenant ID, collects incidents for every managed company. Each alarm keeps the company it belongs to, which SOCRadar says stops searches, reports and alerts from mixing customer data. An MSSP Overview dashboard shows alarms, severities and trends per company, with a company filter on every dashboard. Analysts can also update an alarm's status from Splunk, and the change is written back to SOCRadar.

The second app, SOCRadar Vulnerability, brings SOCRadar's vulnerability findings into Splunk. SOCRadar notes that external findings, such as exposed services, outdated software with known CVEs and weak mobile app builds, are usually reviewed in a separate tool, away from the asset, identity and network data that shows which matter most. Both apps draw on the SOCRadar platform, which correlates threat intelligence, brand protection, dark web monitoring and external attack surface management into prioritised, validated alarms.

SOCRadar Splunk MSSP Threat Intelligence Attack Surface Management

Summarised by CISO AI from SOCRadar, written with Claude Sonnet 5.5. We link back to every original so you can read it yourself.