Splunk AI Copilot
A security-analysis copilot that installs into Splunk as a native app: natural-language log queries, alert triage and investigation, detection-rule drafting, and an operations layer for the SOC.
What it is
Splunk AI Copilot is a Splunk app (.spl). It installs on the search head and runs there: no separate service, no extra database. Queries run through Splunk search, state lives in the KV store, login and roles are Splunk's own. Analysts ask in plain language; the copilot writes read-only SPL, runs it and explains the result. Hand it one alert and it gathers its own evidence, draws the attack chain and gives a verdict, which can be written back to the Enterprise Security notable or opened as a ServiceNow / Jira ticket.
It is the same product line as Elastic AI Copilot: same shell, pages and workflows. Only the query language, data sources and jump targets are Splunk's.
What it does
| Capability | What | Paid? |
|---|---|---|
| Smart query | Natural language → read-only SPL, dry-run repair, follow-up turns; an offhand correction becomes a knowledge-base rule | Free |
| Search-bar commands | | copilot "question" generates and runs SPL from the Splunk search bar; | splexplain explains and optimizes a query | Free |
| Field masking | Cloud / private / air-gapped modes, applied before data leaves the instance | Free |
| Posture, live alerts, reports, audit, runbooks, assets, baseline, data onboarding | Operational data, summarised, archived and governed | Free |
| Batch triage | Cluster, score and rank a batch of alerts, with noise-reduction suggestions | Paid |
| Alert investigation | Autonomous evidence gathering around one alert: timeline, attack chain, blast radius, false-positive verdict; write back to ES or open a ticket | Paid |
| Detection-rule drafting | Description → a deployable scheduled saved search (SPL + schedule + trigger + MITRE), one-click deploy; ATT&CK coverage heatmap | Paid (sealed delivery) |
| Platform-health interpretation | Root cause and read-only SPL for the Splunk check-up findings | Paid |
Paid capabilities need an activated licence; the enterprise tier includes everything. A 14-day trial can be requested from the activation page. The detection engine ships as ciphertext; its key comes with the licence, so an unlicensed instance cannot run it.
Where to start
Quick start
From the .spl to a first answered question, about ten minutes.
Installation
Version requirements, the two packages, configuration, roles and permissions, upgrade and backup.
User guide
What each page is for and where it stops: query, triage, investigation, rules, posture, onboarding, settings.
Troubleshooting
Symptoms to causes; error-code lookup.