Digital Audit: Splunk Inc.

Audit Phase: Digital (Digital / Technology Forensics) Subject Entity: Splunk Inc. (wholly owned subsidiary of Cisco Systems, Inc. since 18 March 2024) Headquarters: San Francisco, California, United States Audit Date: June 2026 Evidence Base: Published corporate disclosures, Splunk and Cisco press releases and product documentation, Splunkbase and vendor integration pages, Israeli corporate-registry and trade-press records, NGO/BDS publications, and conference materials. All factual claims are drawn from publicly available sources cited in the End Notes.

Scope and directionality note: Digital assesses the digital/technology nexus to Israel. The serious case is the provision of surveillance, digital, data, log-analytics, or cyber technology to the Israeli state, military, or security services. The reverse direction - Splunk procuring technology from Israeli-origin vendors, or Israeli-origin tools feeding telemetry into Splunk - is recorded explicitly and weighted far lower than provision. No transitive guilt is imputed: an integration partner’s other clients, a founder’s military background, or Splunk’s parent group’s separate activities are not attributed to Splunk except where directly evidenced. US-entity relationships (Microsoft, AWS, Google Cloud) are not Israeli-origin and are noted only for completeness.

Enterprise Technology Stack & Vendor Relationships

Corporate Structure & Ownership (Direction: context)

Splunk Inc. was acquired by Cisco Systems, Inc. for $157 per share in cash, approximately $28 billion in equity value; Cisco announced a definitive agreement on 21 September 2023 and completed the acquisition on 18 March 2024.¹²³ Splunk now operates as a wholly owned Cisco subsidiary and continues to market products under the Splunk brand.³ Cisco’s separate, long-standing Israeli activities (addressed below) are structurally upstream of Splunk but are attributed to Splunk only where directly evidenced.³

Israeli-Origin Technology Integration Partners (Direction: inbound telemetry into Splunk)

Splunk’s platform functions as a central SIEM, SOAR, and observability system into which third-party security tools feed log telemetry. Several Israeli-origin or Israeli co-founded security vendors maintain published integrations with Splunk. In each case the direction is the partner’s product forwarding data into Splunk (or Splunk triggering an action in the partner tool) - an interoperability relationship, not Splunk providing technology to any Israeli entity, and not Israeli code embedded in Splunk’s own product.

Check Point Software Technologies (founded Israel; HQ Tel Aviv): The “Check Point App for Splunk” and the “Splunk Add-on for Check Point Log Exporter” forward Check Point firewall, threat-prevention, and SmartEvent logs into Splunk, with documented compatibility with Splunk Enterprise Security; both are published on Splunkbase and in Splunk and Check Point documentation.⁴⁵⁶
CyberArk Software (founded Israel; HQ Petah Tikva / Newton MA): The “Splunk Add-on for CyberArk” (and the CyberArk EPM add-on) pull privileged-access, vault, and Privileged Threat Analytics events into Splunk via syslog/CEF, per Splunk and CyberArk documentation; published on Splunkbase.⁷⁸
Palo Alto Networks / Cortex XSOAR (Israeli co-founders; XSOAR acquired from Israeli-founded Demisto in March 2019): The “Demisto Add-on for Splunk” and the SplunkPy integration push incidents and events between Splunk and Cortex XSOAR; the Demisto add-on’s latest version was released 21 October 2025, indicating an actively maintained relationship.⁹¹⁰

No public evidence was identified that any Israeli-origin software is embedded in Splunk’s own product code, core cloud data pipeline, or licensed at the OEM level; the above are integration/data-ingestion relationships only.⁴⁷⁹

Israeli Splunk User Community & Local Ecosystem

The “Israel Splunk User Group” is an officially listed Splunk regional user group; its published past events were hosted at corporate venues including Cisco TLV (Tel Aviv) and AWS, and its volunteer leaders are listed as being affiliated with Israeli integrators Govil and Bynet.¹¹ Splunk products are distributed and implemented in Israel through local integrators, with trade reporting naming EMET Computing (part of the Tel Aviv-listed EMET group) as an integrator and reporting “some 200 clients” in Israel.¹²

Procurement & Integrator Relationships

Splunk maintains a global systems-integrator and distribution ecosystem; Carahsoft is its named public-sector distributor (US public sector).¹³ No public evidence was identified that any named global integrator mandates Israeli-origin technology as a component of Splunk deployment engagements.

Surveillance, Biometrics & Retail Technology

Facial Recognition & Biometrics

Splunk is not a retail technology company and does not operate physical retail environments. No public evidence was identified of Splunk deploying or licensing facial-recognition, biometric-identification, gait-analysis, or frictionless-checkout technology - Israeli-origin or otherwise - for its own operations or as a product. No public evidence identified.

Splunk’s core product (SIEM, SOAR, observability) is a general-purpose log-aggregation and analytics platform used by Splunk customers. No public evidence was identified that Splunk itself deploys Israeli-origin predictive-policing, biometric workforce-monitoring, sentiment-analysis, or population-surveillance tools. No public evidence identified.

Third-Party Surveillance Delivery

No public evidence was identified that Israeli-origin surveillance technology reaches Splunk’s own infrastructure via bundled or embedded third-party services. No public evidence identified.

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

Cloud Hosting Architecture

Splunk Cloud Platform is a SaaS offering whose data may be stored in available AWS, Microsoft Azure, or Google Cloud regions; Splunk’s published service details list global regions in the US, EU (Dublin, Frankfurt), Asia-Pacific, and South America, with no Israel region named.¹⁴ AWS, Azure, and Google Cloud are US-entity providers, not Israeli-origin. No public evidence was identified that Splunk routes customer data through any Israel-based cloud region or contracts dedicated colocation/data-centre capacity within Israel.¹⁴

Data Centre Operations in Israel

No public evidence was identified that Splunk operates, leases, or co-locates data-centre infrastructure within Israel.

Project Nimbus & Israeli State Cloud Infrastructure

Project Nimbus is the Israeli-government cloud contract awarded to Amazon Web Services and Google Cloud; Splunk is a software platform that runs atop cloud infrastructure and is not a Nimbus prime contractor.¹⁵ No public evidence was identified of Splunk holding a direct sub-contract, named work order, or stated role within Project Nimbus. Sub-contractor/ISV relationships below the AWS/Google prime level are not publicly disclosed, so embedding of Splunk software within Nimbus-scoped infrastructure can be neither confirmed nor excluded from public records.

Data-Sovereignty / Resilience Services to Israeli State Institutions

No public evidence was identified that Splunk markets or has contracted data-sovereignty, data-residency, or infrastructure-resilience services specifically to Israeli state institutions or military bodies. No public evidence identified.

Defence, Intelligence & Security Sector Technology Relationships

Provision to the Israeli Military (Direction: Splunk as provider - the directionally serious case)

Israeli defence trade publication Israel Defense reported (25 January 2019) that “the Israeli military (IDF) is one of Splunk’s major clients in Israel,” and quoted an IDF source stating that “the IDF maintains an extensive range of agreements with suppliers in the field of data extraction, including the Splunk Company, for the benefit of improving the operational effectiveness of the IDF.”¹² The same report stated Splunk operated in Israel through integrators including EMET Computing, served “some 200 clients” in the country, and “is currently preparing to establish a local sales office.”¹² The article additionally discussed potential military data-fusion applications of the platform and referenced Israeli military command/fire systems including “TZAYAD (Digital Land Army)” and “Fire Weaver”; this latter portion is the publication’s characterisation of potential use cases, not a documented Splunk contract for those systems.¹² This is the most directionally significant Digital finding: a named trade-press report, with an attributed IDF-source statement, identifying the IDF as a major Splunk customer.

Splunk Israel Local Entity & Sales Presence

A locally registered company, Splunk Services Israel Ltd. (Hebrew: ספלאנק סרוויסס ישראל), is recorded in the Israeli Registrar of Companies under registration number 516040250, located at HaMelacha 32, Netanya, and listed as active with registry updates through 2025.¹⁶ Splunk has also advertised a “Regional Sales Manager, Israel” role on its careers portal (the page now redirects to Cisco’s Splunk careers site), and LinkedIn lists multiple Splunk job postings in the Tel Aviv District.¹⁷¹⁸ This corroborates the 2019 trade-press report that Splunk was establishing a local Israeli sales presence.

Israeli State Security & Critical-Infrastructure Use (Direction: Splunk as provider)

Splunk conference material (.conf19) documents Israel’s Ministry of Energy applying Splunk Enterprise with machine learning to protect critical energy infrastructure and operational-technology (OT) environments across the country’s power plants, presented as a national security-posture monitoring deployment.¹⁹ This is a civilian ministry analytics/critical-infrastructure deployment. No public evidence was independently identified of verified Splunk contracts with the Israel Police, Shin Bet, Mossad, the Israel National Cyber Directorate, or the Israeli Ministry of Defence as named institutional customers (as distinct from the IDF reporting above).

Indirect Channel Exposure

Splunk and Cisco products are distributed in Israel through Cisco’s and Splunk’s Israeli channel-partner/reseller network (e.g. Bynet, EMET).¹¹¹² BDS-movement material separately alleges Cisco “sold Webex … to the Israeli military in partnership with Bynet,” but this concerns a Cisco product, not Splunk.²⁰ It is structurally possible that Splunk licenses reach Israeli government or defence end-users through this indirect channel; beyond the IDF reporting and the Ministry of Energy deployment cited above, no further specific end-user contract was publicly confirmed.

Dual-Use Technology Profile

Splunk’s SIEM/SOAR platform is inherently dual-use: a general-purpose log-aggregation, threat-detection, and incident-response tool used by government, law-enforcement, and commercial security operations centres worldwide.¹⁴ No NGO documentation or official disclosure was identified confirming Splunk technology deployed specifically for military, intelligence, or law-enforcement surveillance applications within Israel or the Occupied Palestinian Territories.

Offensive Cyber & Weapons Systems

No public evidence identified. Splunk does not develop, sell, or license offensive cyber capability, exploit tooling, or systems designed to produce targeting decisions; its product line is defensive and observability-oriented.¹⁴

AI, Algorithmic & Autonomous Systems

AI/ML Platform Capabilities

Splunk integrates machine-learning capabilities into its platform, including the Splunk Machine Learning Toolkit and AI-assisted anomaly detection within Splunk Enterprise Security, as general-purpose analytical tools available to all customers.¹⁴¹⁹

Provision to Israeli State Bodies

The Israel Ministry of Energy deployment documented at .conf19 used Splunk’s machine-learning capabilities for critical-infrastructure/OT security analytics.¹⁹ Beyond this civilian critical-infrastructure use, no public evidence was identified that Splunk’s AI/ML capabilities have been provisioned to Israeli military or intelligence bodies under named bespoke agreements.

Training Data & Model Development Involving Israeli Population Data

No public evidence was identified that Splunk’s AI/ML models are trained on civilian population data, intercepted communications, or surveillance-derived datasets originating from Israel or the Occupied Palestinian Territories. No public evidence identified.

Autonomous Systems & Lethality

No public evidence identified. Splunk does not produce autonomous target-generation systems, fire-control AI, or kill-chain automation; its AI capabilities are directed at IT and security-operations use cases.¹⁴

Technology Ecosystem & R&D Footprint

Splunk R&D in Israel (Pre-Acquisition)

No public evidence was identified that Splunk, prior to the Cisco acquisition, operated a dedicated R&D centre, engineering office, or innovation laboratory within Israel; its primary recorded Israeli footprint was a sales/services presence (Splunk Services Israel Ltd., Netanya) and channel distribution.¹⁶¹²

Cisco Israel R&D (Post-Acquisition Parent)

Cisco maintains a substantial, long-standing R&D presence in Israel - reported R&D centres in Netanya, Caesarea, and Tel Aviv employing around 500 people, built through more than a dozen Israeli acquisitions over prior decades.²¹ Notably, Cisco’s Israel Development Center is in Netanya, the same city as the registered Splunk Services Israel Ltd. address.¹⁶²¹ No public disclosure was identified confirming whether Splunk-branded engineering or product-development work is conducted from Cisco’s Israeli offices.

Acquisitions of Israeli Technology Companies

Splunk’s published acquisitions list (SignalFx, Phantom Cyber, Plumbr, TruSTAR, Flowmill, TwinWave, Omnition, Streamlio, Rigor, VictorOps, SnapAttack and others) records no acquisition identified in public sources as an Israeli-domiciled company; the documented headquarters of these targets are in the US and Europe (e.g. Plumbr, Estonia).²² No public evidence was identified of Splunk acquiring an Israeli-origin technology company. (Splunk’s parent Cisco has acquired numerous Israeli companies, but those are Cisco acquisitions, not Splunk’s.)²¹

Splunk Ventures Investment Portfolio

Splunk’s strategic investment arm, Splunk Ventures, has disclosed a portfolio of security and observability startups.²² No Israeli-domiciled startup was identified in its publicly disclosed portfolio; the portfolio is not exhaustively published, so undisclosed Israeli investments cannot be positively excluded.

Patents & IP Co-Development with Israeli Institutions

No public evidence was identified of patent portfolios, licensing, or co-development arrangements between Splunk and Israeli-domiciled entities or research institutions (Technion, Hebrew University, Weizmann Institute). No public evidence identified.

Civil Society Scrutiny & Regulatory History

NGO & Academic Scrutiny

No public evidence was identified of a dedicated NGO investigation, academic study, or UN report profiling Splunk’s own technology relationships with the Israeli state or military. The Who Profits Research Center database returns no standalone Splunk profile.²³ The No Tech For Apartheid campaign’s published materials focus on Google and Amazon (Project Nimbus) and Microsoft, and do not name Splunk in their core campaign pages.²⁴

BDS Campaigns

The BDS Movement names Splunk as part of the Cisco group of companies subject to its Cisco boycott call, listing “Splunk” among Cisco products consumers are urged to boycott and Cisco-group entities (alongside Meraki, Duo, ThousandEyes, AppDynamics, Jasper) targeted for divestment.²⁰ The grounds stated are Cisco’s alleged settlement Tech-Hub operations, employment practices, military sales (e.g. the alleged Webex sale to the Israeli military via Bynet), and acquisitions of Israeli companies - the campaign attributes these to Cisco the parent; Splunk is named by virtue of its ownership by Cisco rather than on independently documented Splunk-specific grounds.²⁰

Export Controls & Sanctions Authorities

No public evidence was identified of any action by US export-control, sanctions, or other regulatory authorities relating to Splunk technology sales, services, or data transfers to Israeli state entities. No public evidence identified.

Regulatory & Legal Actions - Technology Sales to Israeli State Entities

No public evidence was identified of any regulatory inquiry, sanctions investigation, or legal challenge concerning Splunk’s technology sales or services to Israeli state entities. No public evidence identified.