Digital Audit - Splunk

Domain: Digital - Digital / Technology Entity scope: Splunk Inc. - the SIEM / security-analytics software company (a wholly-owned Cisco business since March 2024). Splunk-brand/corporate’s OWN technology and Israel footprint are in scope; Cisco-parent’s separate Israel R&D and acquisitions are attributed at parent level unless specifically a Splunk-brand act. Only genuinely Israeli-domiciled entities/operations are counted in scope. Compiled: 2026-06-24 Method: Live web search only

Enterprise Technology Stack & Vendor Relationships

Splunk’s core suite - Splunk Enterprise, Cloud Platform, Enterprise Security, and SOAR - is self-developed technology that ingests machine-generated data (logs, events, metrics, traces) for search, visualisation, and analytics; since March 2024 Splunk operates as a wholly-owned business unit of Cisco (~$28bn acquisition).¹² Splunk maintains an Israeli subsidiary, Splunk Services Israel Ltd. (ICA 516040250; incorporated 16 June 2019; Hamelacha 32, Netanya), active through early 2026; public records identify it as a services entity, and job postings advertise sales/sales-engineering roles, with no R&D/engineering designation authoritatively confirmed in public sources.³⁴⁵

Splunk Ventures - Ermetic (Tel Aviv). Splunk’s corporate venture arm made a documented strategic minority investment in Ermetic, a Tel Aviv-based cloud-security (CIEM/CSPM) company, announced March 2022; Ermetic was subsequently acquired by Tenable in 2023 (~$265–350m).⁶⁷⁸ Ermetic was a genuinely Israeli-domiciled company - a venture investment/technology-integration partnership, not a Splunk acquisition. No other Israeli-domiciled company was identified in Splunk’s acquisition record: across ~18–22 acquisitions, the geography is US (most) and Estonia (Plumbr)/Greece (BugSense), and specifically-checked candidates - Caspida (Palo Alto, CA), Phantom Cyber (Palo Alto, CA), SignalFx, TruSTAR, Flowmill, Rigor, Streamlio, TwinWave, KryptonCloud, Drastin, SignalSense - show no Israeli founding or domicile.⁹¹⁰¹¹

Cisco-parent attribution. Cisco has an extensive Israel R&D presence and Israeli acquisitions (e.g. Intucell, Leaba Semiconductor, Kenna Security); these are parent-company operations, attributed to Cisco and not to Splunk-brand, and no public evidence identified of Cisco’s Israel R&D being merged into Splunk-brand product lines since March 2024.

Surveillance, Biometrics & Retail Technology

Splunk’s flagship product is, by design, a large-scale data-aggregation/indexing/search platform that can ingest logs from surveillance systems, physical-access systems, endpoint agents, network devices, and communications infrastructure; Splunk classifies its security product as a SIEM with integrated UEBA (User and Entity Behaviour Analytics), enabling real-time behavioural monitoring, anomaly detection, and insider-threat identification across user populations.¹² These capabilities are surveillance-adjacent by design (centralising monitoring of users, assets, and network activity at enterprise scale), and the IDF’s confirmed use of Splunk (see Defence/Intelligence below) places the platform in an operational military-surveillance context. No public evidence identified of Splunk biometric products, retail-sector surveillance products, or purpose-built surveillance products supplied to Israeli entities beyond its general-purpose data platform.

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

Splunk Cloud Platform lets customers select a data-storage region among available AWS, Azure, or Google Cloud regions to meet data-residency requirements; public documentation does not identify an Israel-specific Splunk Cloud region.¹³ Splunk Cloud supports US Government IL5 deployments for US DoD customers, but no equivalent Israeli public-sector cloud certification was publicly announced, and no public evidence identified of Splunk maintaining dedicated Israeli data-residency infrastructure or participating in any Israeli sovereign-cloud programme.¹⁴

Defence, Intelligence & Security Sector Technology Relationships

The Israel Defense publication (January 2019) reported, citing an IDF official statement, that “the IDF maintains an extensive range of agreements with suppliers in the field of data extraction, including the Splunk Company, for the benefit of improving the operational effectiveness of the IDF,” and identified the IDF as “one of Splunk’s major clients in Israel”; the article speculated about TZAYAD and Fire Weaver applications but did not confirm operational deployment in those systems.¹⁵ The Israeli Ministry of Energy is a confirmed Splunk customer, using Splunk Enterprise with machine learning as a centralised SIEM to monitor SCADA/OT environments protecting national power-grid critical infrastructure.¹⁶ Splunk publishes a “Defense and Intelligence Agency” vertical (with all four US military branches and numerous US intelligence agencies as customers) - a general commercial positioning whose Israeli-specific manifestation is the IDF relationship above.¹⁷ Splunk also exhibited/spoke at Cybertech Tel Aviv 2020.¹⁸

AI, Algorithmic & Autonomous Systems

Splunk has embedded ML/AI into its core platform since 2015 - unsupervised ML in Splunk UBA for anomaly detection, ML-powered correlation in Enterprise Security, and natural-language query - integrated into its general commercial product, with no Israel-specific AI/algorithmic development programme identified.¹²¹⁹ Splunk Ventures’ Ermetic (Tel Aviv) investment involved a cloud-entitlement AI/ML product (least-privilege access recommendations) - a product-level partnership between two distinct commercial entities, not Splunk-internal R&D.⁶ No public evidence identified of Splunk developing autonomous weapons-relevant AI or supplying AI components specifically to Israeli military programmes.

Technology Ecosystem & R&D Footprint

Splunk Services Israel Ltd. (Netanya, incorporated June 2019) is confirmed in Splunk’s SEC subsidiary listings for FY2022–FY2023; public job listings advertise sales/sales-engineering roles, with no R&D/engineering job postings or office announcements identified - the registered address and entity name are consistent with a sales/support office rather than a dedicated R&D campus, though the functional split is not authoritatively confirmed.²⁰²¹ No Splunk acquisition was identified as Israeli-founded/domiciled (Caspida was a Palo Alto company; no Israeli founding confirmed).²² Ermetic (Tel Aviv) is the only confirmed Israeli-domiciled company in Splunk Ventures’ accessible portfolio.⁶⁷ Splunk maintains an active official Israel Splunk User Group.²³ Cisco-parent note: post-acquisition, Splunk’s careers page redirects to Cisco’s portal (which lists Israel as a Cisco location); the extent to which Cisco’s Israel engineering works on Splunk-branded products is not confirmed in any public source.

Civil Society Scrutiny & Regulatory History

No civil-society organisation or regulatory body was identified as having published a specific investigation, campaign, or finding regarding Splunk’s Israel operations, use by the IDF, or role in the occupation; the IDF relationship (2019 Israel Defense article, based on an IDF statement) has not generated a documented civil-society response. Splunk’s SIEM/log-analytics platform is noted generally in privacy/digital-rights literature as a class of technology enabling large-scale behavioural monitoring, but no Splunk-specific civil-society report targeting its Israeli deployments, and no regulatory investigation or sanction related to Splunk’s Israel operations or exports, was identified.

End Notes