Privacy Policy

The Splunk App is a custom alert action that runs inside your Splunk environment. The App itself is outbound-only: it does not connect back to, authenticate against, or query Splunk — it only sends data outward to Mars. Through the App, Mars receives data only when a saved search you have explicitly configured with the “Send to Mars” action triggers. On each such trigger, Mars receives:

• Alert results. A capped subset of the matching rows from the saved search (the true total match count is also reported). These rows contain whatever fields your search returns, which may include personal or identifying data such as usernames, email addresses, IP addresses, or hostnames, depending on how your search is written.
• Search context. The search query (SPL), the saved search name and description, the owner, the schedule, the time range, and a link back to the results in Splunk.
• Severity. The alert severity on Splunk's 1–5 scale, either the saved search's configured value or a per-action override.
• Delivery credential. A Mars-issued webhook token, sent by the add-on to authenticate each delivery. The token is generated in Mars and stored encrypted inside your Splunk configuration; Mars retains it to validate inbound deliveries.

Scope of the Splunk App. The App does not run searches, does not read any data other than what a triggered, configured saved search forwards, and does not receive anything back from Mars. You control which saved searches forward data and what those searches return.

We use the information above strictly to:

• Ingest the forwarded alert into your Mars tenant so it can be used in your security workflow (for example, as an input to threat hunts).
• Authenticate and attribute each delivery to the correct Mars tenant using the webhook token.
• Operate, secure, and troubleshoot the service, including investigating misuse or abuse.
• Comply with legal obligations.

We do not use your data for advertising, profiling unrelated to security investigations, building external products, or training general-purpose AI models. We do not sell your data.

We share information only with trusted subprocessors. A full list is available on our sub-processors page. Categories include:

• Cloud infrastructure providers (e.g., Amazon Web Services) for hosting, storage, and networking.
• LLM providers (e.g., OpenAI, Anthropic, Azure OpenAI) used by Mars's investigation and hunting agents.
• Operational tooling such as error monitoring and logging providers.

We do not share your data with third parties for their own marketing or advertising purposes.

• Webhook token is retained until you revoke or rotate it in Mars, or until your contract with Mars ends, whichever comes first.
• Forwarded alert payloads (results, SPL, severity, metadata) are retained as operational records for up to 90 days by default, then automatically deleted, except where they have been incorporated into hunt or investigation outputs.
• Hunt and investigation outputs are retained according to your organization's contract with Mars and are governed by the in-product privacy notice.

You can request deletion at any time by emailing mars-support@marssec.ai.

• Access: request a copy of the personal data we hold about you.
• Correction: request correction of inaccurate or incomplete data.
• Deletion: request deletion of your data, subject to legal retention obligations.
• Portability: request a copy of your data in a machine-readable format.
• Objection / restriction: object to or restrict certain processing.

To exercise any of these rights, contact mars-support@marssec.ai.