Splunk

Key Findings

• Economic: Splunk maintained an Israeli subsidiary, Splunk Services Israel Ltd., and an Israeli government authority issued a 2021 tender for Splunk licences, support, and professional services; no award or contract value was identified.^{1, 2}
• Military: A 2019 trade-publication report quoted an IDF statement identifying Splunk among data-extraction suppliers, but no direct Splunk-corporate-to-IDF contract, value, unit, or confirmed weapons-system integration was publicly identified.³
• Political: Splunk had no identified standalone public position on Israel/Palestine before its March 2024 acquisition by Cisco; post-acquisition Cisco-parent activity must remain attributed to Cisco rather than the Splunk brand.^{4, 5}
• Not found: No public evidence identified of Splunk operations in settlements, direct supply to Israeli defence primes, military-platform integration, or Israeli sovereign-cloud infrastructure.^{3, 6}

Target Profile

Key Facts:

• Splunk Services Israel Ltd. was incorporated on 16 June 2019 and is recorded in Netanya; public job material identified sales and sales-engineering roles, not a confirmed R&D campus.^{1, 10}
• Splunk Ventures announced a strategic minority investment in Tel Aviv-based Ermetic in 2022; Tenable acquired Ermetic in 2023.^{9, 11}

Executive Summary

Splunk is an enterprise software company whose products collect, index, search, and analyse machine-generated data for security, observability, and operational use.⁸ Its documented Israel nexus comprises an Israeli services subsidiary, an Israeli government tender for product licences and services, a Ministry of Energy customer case study, and a reported IDF supply relationship conducted through local integrator/reseller channels.^{1, 2, 3, 12}

The most material direct Splunk-brand record is the January 2019 Israel Defense report. It quoted an IDF statement that the military had agreements with data-extraction suppliers “including the Splunk Company,” and described the IDF as a major Splunk client in Israel.³ That source does not establish a direct corporate procurement contract, contract value, specific military unit, or deployment in TZAYAD, Fire Weaver, a weapons platform, or any other named system.³ The dossier therefore treats the relationship as reported, reseller-mediated supply evidence rather than verified direct defence contracting.

The economic record supports an Israeli corporate and market presence but does not quantify its scale. The 2021 National Digital Agency/Government ICT Authority tender sought Splunk licences and professional services, but reviewed materials did not identify a successful bidder, executed contract, end user, value, or deployment.² Splunk’s filings similarly do not disclose Israeli workforce, revenue, tax, profit-repatriation, or operational-function figures.^{1, 13}

Several allegations or possible extensions are not supported by the audited record. No public evidence identified Splunk facilities or operations in West Bank, East Jerusalem, or Golan settlements; direct supply to Elbit, Rafael, or IAI; direct integration into weapons systems; Israeli data-residency infrastructure; or a Splunk-specific civil-society investigation or boycott campaign.^{3, 6, 14} Cisco’s separate Israeli military, security, and settlement-related record after the acquisition is material contextual information, but is attributed to Cisco-parent and not retroactively treated as Splunk-brand conduct.^{5, 15}

The fixed human-vetted V4 result is BRS 564, Tier C (High). The result retains the audited political and economic nexus while assigning zero Military and Digital scores, reflecting the limits on direct, verified Splunk-specific military and digital deployment evidence.

Timeline of Relevant Events

Corporate Overview

Splunk’s core suite includes Splunk Enterprise, Cloud Platform, Enterprise Security, SOAR, and related security and analytics products.⁸ It was an independent public company until Cisco completed its acquisition in March 2024.⁵ The acquisition does not erase the distinction between Splunk’s pre-acquisition conduct and Cisco’s separate corporate relationships; this dossier maintains that attribution boundary throughout.

The audited record confirms Splunk Services Israel Ltd. as an Israeli subsidiary. Public sources identify it as a services entity and show Israel sales/sales-engineering recruitment, but do not authoritatively establish its workforce, revenue, ownership percentage, tax status, address in corporate schedules, or whether it operated as an R&D office.^{1, 10, 13} Splunk also maintained an Israel Splunk User Group, a regional community and marketing channel.¹⁷

Splunk Ventures’ Ermetic investment was a strategic minority investment and technology partnership, not a Splunk acquisition or evidence that Ermetic became a Splunk operating subsidiary.⁹ Audited acquisition materials did not identify an Israeli-domiciled operating company acquired by Splunk.¹⁸

Domain Summaries

Military: Military

Mechanism of Involvement

The principal record is the 2019 Israel Defense report quoting an IDF statement that its supplier agreements in data extraction included Splunk.³ The same reporting described Splunk’s Israeli activity through integrators, including EMET Computing, supporting characterization as an acknowledged reseller/integrator-tier relationship rather than a publicly disclosed direct procurement contract.³

Splunk markets its general-purpose analytics and security products to aerospace, defence, and intelligence customers, including US entities. Its US Department of Defense business is documented, but it is not evidence of Israeli military supply.¹⁹ Splunk software is export-classified as dual-use information-security software under EAR ECCN 5D002; no ITAR applicability was identified.²⁰

Counter-Arguments and Evidence Limits

The strongest defence is that no public source identified a direct Splunk-corporate-to-IDF contract, procurement value, military unit, or confirmed operational deployment in a named IDF system.³ The report’s discussion of TZAYAD and Fire Weaver was contextual and did not state that Splunk powers either system.³ No public evidence identified Splunk as a component of munitions, weapons systems, strategic platforms, base services, or direct supply chains for Israeli defence primes.³

Cisco-parent military relationships are not attributed to Splunk-brand. The acquisition date establishes a corporate relationship, not evidence that Cisco’s pre-existing military supply was undertaken by Splunk.^{5, 15}

Named Entities and Evidence Map

Digital: Digital

Mechanism of Involvement

Splunk’s SIEM and analytics products aggregate logs, events, metrics, traces, network data, endpoint information, and related machine-generated data.⁸ Its UEBA capabilities support behavioural monitoring, anomaly detection, and insider-threat identification across enterprise populations.²¹ These are surveillance-adjacent capabilities in general, but the audits did not identify a purpose-built Splunk surveillance or biometric product supplied to Israeli entities.²¹

The Israeli Ministry of Energy is a confirmed Splunk customer, using Splunk Enterprise and machine learning in a centralised SIEM environment for SCADA/OT monitoring of power-grid critical infrastructure.¹² Splunk also exhibited at Cybertech Tel Aviv in 2020.²²

Counter-Arguments and Evidence Limits

No public evidence identified a dedicated Israeli Splunk Cloud region, sovereign-cloud participation, Israeli public-sector cloud certification, biometric deployment, or autonomous-weapons-relevant AI programme.^{6, 21} The reported IDF relationship does not establish that Splunk was integrated into specific surveillance, targeting, command-and-control, TZAYAD, or Fire Weaver systems.³

The Israeli subsidiary’s available job material supports sales/support activity but not a confirmed Splunk R&D campus. Cisco’s broader Israel engineering footprint cannot be assumed to work on Splunk-branded products.^{1, 10}

Named Entities and Evidence Map

Economic: Economic

Mechanism of Involvement

Splunk’s confirmed economic nexus is its Israeli subsidiary and the Israeli market activity reflected in Tender 7/2021.^{1, 2} The tender sought Splunk Core and Enterprise Security licences, support, professional services, and relevant supplier certifications; it also contemplated security screening/classification where required.² Splunk’s public materials also document the Ministry of Energy customer relationship.¹²

Splunk Ventures’ minority investment in Ermetic is a documented Israeli technology-sector investment. It did not constitute a Splunk acquisition, and no other Israeli-domiciled Splunk acquisition was identified in the reviewed record.^{9, 18}

Counter-Arguments and Evidence Limits

Tender publication does not prove an award, executed contract, payment, licence quantity, government end user, or continuing deployment.² No public evidence identified physical-goods sourcing, factories, logistics hubs, data centres, real-estate holdings, Israeli sovereign-bond holdings, Israeli state ownership, or quantified Israeli revenue, taxation, employment, or profit flows.^{13, 23}

No public evidence identified Splunk facilities, contracts, sales, services, or operations in settlements or occupied Syrian Golan territory.⁶ A source-scoped AFSC search returned no Splunk match; this is not proof of no activity beyond that source’s scope.¹⁴

Named Entities and Evidence Map

Political: Political

Mechanism of Involvement

No standalone Splunk public statement on Israel/Palestine was identified before the Cisco acquisition.⁴ Splunk did issue a public conflict-specific post concerning Russia’s invasion of Ukraine in 2022, creating a documented contrast with the absence of an identified equivalent Splunk statement on Palestinian civilian harm.²⁴

Splunk’s Israeli subsidiary, user group, Ministry of Energy case study, and reported IDF customer relationship establish institutional and market ties, but do not by themselves establish a public political endorsement of Israeli policy.^{1, 3, 12, 17} After March 2024, Cisco’s public communications and Israel-related activity are parent-company conduct and should not be transposed onto Splunk’s historical record.^{5, 15}

Counter-Arguments and Evidence Limits

The strongest defence is the absence of a documented Splunk-specific political position, Israel/Palestine lobbying effort, PAC activity, Israel-focused advocacy role, or conflict-period crisis donation to Israeli state, military, or NGO recipients.^{4, 25} OpenSecrets recorded no reported federal lobbying activity or outside spending for Splunk in the 2022 cycle.²⁵

No public evidence identified Splunk in the reviewed UN/OHCHR settlement-related materials, Who Profits database, current BDS targeting, or a Splunk-specific civil-society campaign.^{14, 26} Cisco’s presence in civil-society material is a parent-level matter; it does not establish an independent Splunk campaign target.^{15, 26}

Named Entities and Evidence Map

BDS-1000 Score (V4)

• V_MAX: 6.43 Avg_OTHERS: 1.67
• BRS Score: 564 Tier: C (High)

The fixed V4 outcome is driven by Political as the highest domain score, with Economic reflecting the documented Israeli corporate and market nexus. Military and Digital remain zero because the audit record did not verify direct Splunk contracting, named military-system integration, or Israeli-specific surveillance/cloud deployment at the required evidentiary level. The methodology is scale-free - Impact × magnitude/proximity - and evidence-only, with human vetting applied.

Methodology Note

• Evidence is limited to the four supplied domain audits and their cited source record.
• Impact assesses activity type; M assesses scale; P assesses proximity/directness.
• Claims marked unverified, unresolved, or not publicly identified are retained with those limits or excluded.
• Divested or exited operations mitigate attribution; corporate ownership does not retrospectively convert parent-company activity into subsidiary conduct.
• Entity attribution is non-transitive: Cisco-parent conduct is distinguished from Splunk-brand conduct.
• Settlement activity, where verified, may inform both Economic and Political; no such Splunk activity was identified here.
• “No public evidence identified” denotes the result of the specified audit checks, not proof that activity is impossible.