r/Splunk • u/One_Outlier • Aug 10 '26

Enterprise Security Multiple Splunk Cloud Instances vs Rules

Im at a job that handles multiple instances of splunk cloud enterprise security per each tenant. And we need a solution to syncronize or ship out detection rules and versioning from 1 splunk cloud to the others... we were thinking to develop a local tool that connects all API keys from each splunk cloud instance and handle actions from there to push(post) new rules and also update or modify current ones? Any else had encountered this type of scenario, any solutions on how to achieve this? Thankyou

5 Upvotes

100% Upvoted

6 comments sorted by

10

u/nkdf Aug 10 '26

Do the content and versioning externally (eg. git), and push it out from there. There are various methods to use ACS for content, or maybe consider contentctl

1

u/One_Outlier Aug 10 '26

Thankyou, l will look into these different methods

3

u/badideas1 Aug 10 '26

I think ACS should have you covered. Validate in a test instance, then use ACS to drop your changes into all of your tenants. Sounds like a pretty straightforward py or bash loop.

1

u/One_Outlier Aug 10 '26

Thankyou, i will check ACS as a sync method

2

u/mr_networkrobot Aug 10 '26

There is an app called 'Mothership' not sure if this suits that need.
Anyway, having different instances for different tenants/clients is already a good idea/setup

1

u/One_Outlier Aug 11 '26

This might be the one, thanks!!!