When receiving internal attacks, I'd like to utilize Splunk alerts to trigger an Nmap scan against that attacking host from a remote machine; one other than the Splunk server.
Is there any API or script that would provide this functionality (Splunk alert, get source address, automatically send the address to a remote host to run Nmap (-A) scan against attacker)?
The idea here would be to automatically get additional information on internal hosts that are potentially malicious/compromised. Then, a potential add-on would be to send the scan results back to Splunk for correlation.