SOCRADAR has released two new Splunk apps aimed at MSSPs and multi-tenant environments: SOCRadar Incidents MSSP and SOCRadar Vulnerability. The release targets the friction of managing risk findings across many managed companies, providing a single input and tenant-aware dashboards so alarms from different customers don’t cross boundaries.
The approach emphasises that external vulnerability findings—such as exposed services, out-of-date software with known CVEs, and weak mobile app builds—often sit outside the SIEM, delaying prioritisation unless they’re brought into the same view as asset, identity and network data.
The apps are powered by the SOCRadar platform, which correlates threat intelligence, brand protection, dark web monitoring and external attack surface management into prioritized alarms. SOCRadar Incidents MSSP brings incidents for every managed company into Splunk via one multitenant input, keeps tenant data separate, and offers per-company dashboards with bidirectional status updates that sync back to the SOCRadar side.
SOCRadar Vulnerability collects vulnerability findings from the attack surface (with optional mobile application security findings), supports incremental collection to avoid duplicates, offers built-in dashboards showing severity, affected assets and CVEs, and enables closing the corresponding SOCRadar alarm directly from Splunk once a finding is fixed. Together with existing apps, there are now five SOCRadar apps on Splunkbase, including Incidents, Threat Feeds, TAXII 2.1, Vulnerability, and Incidents MSSP.
The article also outlines a practical workflow: filter by customer, triage a leaked credential alert, patch an exposed CVE, and close alarms without leaving Splunk.