Blog

DarkMoon in Splunk: autonomous pentest results as a SOC data source

Stream campaigns, findings, remediation PRs and retest verdicts into Splunk over HEC as four CIM-aligned sourcetypes, six SOC dashboards including MITRE ATT&CK coverage, and a Send to DarkMoon alert action that turns a correlation search into a non-destructive offensive-validation loop. Redaction-safe by design.

· 8 min read

A SOC already has a system of record, and it is Splunk. Offensive results that live in a separate portal get read once and forgotten. So the DarkMoon Splunk app treats autonomous pentest output as just another data source: it lands in your indexes, it is CIM-aligned, and it drives dashboards next to the rest of your detections.

Ingest over HEC

A forwarder script (forwarder/darkmoon-to-hec.py) pushes DarkMoon results into Splunk over the HTTP Event Collector. No inbound access to your engine is required, the flow is outbound to your HEC endpoint, and the events are structured JSON with stable fields.

Four CIM-aligned sourcetypes

Events arrive as four sourcetypes, with field extractions in props.conf and transforms.conf that map onto the Common Information Model so they play with existing searches:

  • darkmoon:campaign, one event per assessment with target, status and overall risk.
  • darkmoon:finding, one per vulnerability with severity, category, status and MITRE technique.
  • darkmoon:pr, the state of each remediation pull request on Pro.
  • darkmoon:retest, the verdict when an exploit is re-run, fixed, still present, regressed or new.

Six SOC dashboards

The app ships six views under data/ui/views:

  • SOC overview, posture KPIs: active campaigns, critical and high counts, confirmed, exploited, remediation rate, findings over time.
  • Findings, the searchable finding surface.
  • MITRE ATT&CK, technique coverage across your campaigns.
  • Campaigns, the assessment history.
  • Remediation, PR states joined with retest verdicts.
  • Plus setup and health views.

Close the loop: Send to DarkMoon

The interesting part is not just reading results, it is acting on them. The app ships a custom alert action (darkmoon_campaign) so a correlation search can trigger a DarkMoon retest or campaign. A detection fires, and DarkMoon validates whether the exposure is actually exploitable, an offensive-validation loop driven from the SIEM. The defaults are deliberately conservative: action_kind=retest, a non-destructive scope profile, dry_run=1, and a rate limit of six per hour.

Redaction-safe by design

Events carry safe metadata only: ids, severity, status, target reference, MITRE, technology, timestamps, evidence counts and booleans. Evidence bodies, secrets and raw request or response payloads never leave the engine, and an index-time transform additionally strips token-like strings as defence in depth.

Getting started

Point the forwarder at your HEC endpoint, install the app, and the overview dashboard populates as campaigns complete. The app id is darkmoon, it is MIT licensed, and it ships a real-Splunk Docker harness so you can validate the whole flow locally before touching production. See the full integrations catalog for the rest of the ecosystem.

See the proof, not just the write-up: the Pro remediation benchmark (fixes retested against the exploit) · how Darkmoon compares to other AI pentest tools.

← All articles

Run it against your own lab

Darkmoon is open source (GPL-3.0) and self hosted. Clone it, point it at a target you own, and read every line.

View on GitHubDocumentation