Splunk App Install, Configure, and Upgrade

This section describes how to install and configure the IntSights App for Splunk, an external app.

The following table shows the minimum server requirements:

Threat Command subscriptions

To integrate Threat Command data, you must have valid Threat Command subscriptions:

Version updates

The following table shows version updates:

Before you can use the external app with Threat Command you need to add it.

Add external app

Before using an external app, you must add it. There are two parts to adding an app:

• Your admin must enable the app for you to add.
• After that, you add the external app.

To add an external app:

1. From the main menu, select Automation > Integrations.
2. From the Integrations page, click External.
   
3. Click Add new device.
4. Select the Device type.
   A default name is added. If the external device to add isn't displayed, ask your admin to enable it for you.
5. Click Add.

The new device is added.

Installing the IntSights Splunk App

The Splunk app can be installed as a cloud or an on-premises installation. Installation requires the Threat Command account ID and API key. This enables the Splunk app to connect with your Threat Command instance.

Prerequisites

• You have the Threat Command  account ID and API key, as described in API key and account ID.
• You must be able to authenticate with Splunk Enterprise as an administrator.
• You must have access to the Splunk App Store (for cloud installation) or the Splunkbase (for on-premises installation).

To install the IntSights Splunk App in the cloud:

1. Log in to theSplunkbase store.https://store.servicenow.com/
2. Download the IntSights Splunk App.
3. To complete the installation, contact Splunk support.

The application is installed.

To install the IntSights Splunk App as an on-premises application:

1. Log in to the Splunkbase.
2. Download the IntSights Splunk App.
3. Install, using either of the following methods:
   • Extract the ZIP file $SPLUNK_HOME/etc/apps/ folder
   • Install from the UI:
     1. From Splunk Enterprise, chooseApps > Manage Apps.
     2. Click Install app from file.
     3. Click Choose file and select the IntSights Splunk App installation file.
     4. Click Upload.
     5. Restart Splunk Enterprise.

Topologies according to the environment:

1. Standalone Mode

* Install the IntSights Splunk App for Splunk.

* Configure an account and create modular input.

2. Distributed Environment

* Install the IntSights Splunk App for Splunk on the Search Head, Indexer

and On-Premise/IDM/UF/HF.

* Configure an account on both Forwarder and Search Head.

* Create modular input only on Forwarder.

Note that for the distributed environment, only Forwarder indexes will be shown in the input configuration page.

The application is installed.

Configuring the IntSights Splunk App for Splunk account, proxy, and logging

After installation, you must configure the account. You can also configure the proxy (optional) and logging (optional).

Prerequisites

• The IntSights Splunk App for Splunk must be installed.

To configure the account, proxy, and logging:

1. Log in to Splunk Enterprise as a system administrator.
2. Select IntSights Splunk App for Splunk > Setup > Configuration.
   
3. In the Account  tab, enter the Threat Command account ID and API key.
4. (Optional) To verify the SSL certificate, select that option.
5. Click Save.
6. (Optional) To set up the proxy, proceed as follows:
   1. Click the Proxy  tab.
   2. Enable the proxy and enter the required values.
   3. Click Save.
7. (Optional) To set up logging, proceed as follows:
   1. Click the Logging  tab.
   2. Select the log level.
   3. Click Save.

The IntSights App for Splunk User Guide

Click here to download the IntSights App for Splunk User Guide.