Leading & enabling teams · Python & security
Making a Splunk integration safer and easier to set up
An old community package pulled audit logs into security operations centres, but it stored credentials in plain text. I rewrote it.
- My role
- Principal Technical Account Manager
- Organisation
- Own Company
- When
- July – August 2022
- Result
- About 35% fewer support cases
What was going on
Enterprise customers used a JSON package, written by a former TAM, to feed Own Platform audit logs into Splunk so their security teams could monitor key events and access. It had become outdated.
Variables were hard-coded, authentication credentials could be stored in plain text, installation was complex and the documentation was poor. It was treated as open source and unsupported, so customers without developers struggled to customise it.
What I was asked to do
Modernise the package to support the current version of Splunk and a wider set of customers, meet security standards and reduce support queries.
- Remove hard-coded variables and stop storing credentials insecurely, using Splunk’s own configuration pages instead
- Improve logging and error handling in the Python and JSON classes
- Rewrite the installation and configuration guide so people could set it up with minimal help
What I did
- Reviewed the existing Python and JSON classes and replaced hard-coded values, such as API callout URLs and authentication tokens, with configurable fields
- Added encrypted storage for credentials
- Added descriptive log entries at key steps and failure points, so administrators can diagnose problems and confirm data is flowing
- Rewrote the readme with step-by-step instructions, example configurations, library installation and validation steps
What changed
Customers could integrate Own with Splunk more quickly, and customers with their own monitoring needs found it easier to customise.
The result
Within three months of release, support cases about the Splunk integration fell by an estimated 35%. Good documentation and secure design cut operational strain and improved customer satisfaction.
Doing it responsibly
Protecting credentials was the whole point. I was also clear with customers that the package was open source and not officially supported, so they could make informed decisions, and I followed internal governance on open-source contributions.