splunk-security-portfolio-setup

Route security portfolio requests to the correct local setup skill.

36|7|Updated Mar 17, 2026
One-click install
npx skills add https://github.com/chambear2809/splunk-cisco-skills --skill splunk-security-portfolio-setup
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: splunk-security-portfolio-setup
Source: https://github.com/chambear2809/splunk-cisco-skills/tree/main/skills/splunk-security-portfolio-setup
Command: npx skills add https://github.com/chambear2809/splunk-cisco-skills --skill splunk-security-portfolio-setup

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

Route security portfolio requests to the correct local setup skill.

Core Features & Use Cases

  • Classifies coverage as first_class, existing_skill, install_only, partial, bundled_es, or manual_gap.
  • Routes first_class products to the product setup skills in this repo.
  • Generates and previews the exact routed commands via dry-run, render, or execute modes, with machine-readable output when requested.

Quick Start

Start by running a dry-run to preview routing of a product to its setup workflow.

Frequently Asked Questions about splunk-security-portfolio-setup

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I route Splunk security products to their correct setup workflow?

You can route Splunk security products to setup workflows by classifying each request and executing the matching skill-specific setup.sh script, with options for dry-run previews and JSON output.

What Splunk security offerings are supported for automated setup routing?

Supported Splunk security offerings include Enterprise Security, Security Essentials, SOAR, UEBA, Attack Analyzer, ARI, and related products, each classified by coverage level for routing.

Can I preview a Splunk security setup workflow before executing it?

Yes, you can preview setup workflows using the dry-run or render modes, which generate the exact routed commands without executing them, and provide machine-readable JSON output when requested.

How are Splunk security products classified during the setup routing process?

Products are classified as first_class, existing_skill, install_only, partial, bundled_es, or manual_gap, determining whether they route to local setup skills, app-install tooling, or require manual intervention.

Do I need any external dependencies to run the Splunk security portfolio setup router?

No external dependencies are required; the router resolves security portfolio requests locally and executes setup workflows via skill-specific setup.sh scripts or app-install tooling.

What is the best way to handle a partial setup gap for Splunk Enterprise Security?

Partial coverage gaps are classified as manual_gap during routing, allowing you to identify which Splunk Enterprise Security components require manual setup beyond the automated workflow.