Splunk

Splunk Installation

Follow the below steps to install Splunk

1. Create a new VM for Splunk installation. Click here for Splunk installation criteria
2. Download the Splunk installable for Ubuntu using the below steps:
   1. Navigate to the URL: https://www.splunk.com/ and click Free Splunk 
   2. Sign up and click Software Download
   3. Download the installable as a .deb package (for Ubuntu) and copy the downloaded package to the newly created VM
3. Log in to the newly created VM
4. Install the .deb package using the below commands. Provide an appropriate username and password when prompted
   ShellShell

   sudo bash
   dpkg -i <filename>.deb
   

5. Start Splunk using the below commands:
   ShellShell

   cd /opt/spunk/bin
   ./splunk start
   

6. Verification : Access the URL: http://<Splunk_IPAddress>:8000
   1. Log in with the user credentials configured during installation to display the home page

Virsec App Configuration in Splunk

Follow the below steps to install Virsec App in Splunk

1. Virsec App is added to the Splunk App Store. Download the file virsec-security-platform-threat-dashboard_100.tgz from the URL: https://splunkbase.splunk.com/app/4143/ 
2. Click Find More Apps
3. Navigate to Apps > Manage Apps. Click Install App from File
4. Upload the file virsec-security-platform-threat-dashboard_100.tgz from the local system. Click Upload
5. Click Restart Now to restart the Splunk server
6. Click OK on the confirmation pop-up message and click OK to display the login page
7. Log in to Splunk again with valid credentials
8. Navigate to Apps > Splunk for Virsec. The below page is displayed
9. Version 2.9 and Above: Splunk can be configured with SSL being enabled or disabled. By default, SSL is enabled, 
10. Follow the below steps to enable or disable SSL on the Splunk server:
    1. Navigate to Settings > Data Inputs. Click HTTP Event Collector
    2. Click Global Settings
    3. Version 2.9 and Above: Enable or disable the checkbox Enable SSL as required
    4. Versions 2.7 and 2.8: Ensure Enable SSL is unchecked
11. For Version 2.9 and Above: If a switch from HTTPs to HTTP is required, follow the below steps:
    1. Disable the checkbox of Enable SSL on the Splunk server
    2. Delete the Splunk configuration from Administration > Configurations in CMS
    3. Add the below property in the file: /opt/virsec/cms/z-server/config/application.properties in the siem-splunk-service container:
       TextText

       siem.splunk.config.event.collector.disable.certificate=true

    4. Restart the siem-splunk-service using the docker command:
       ShellShell

       restart siem-splunk-service

    5. Reconfigure the Splunk information in CMS under Administration > Configurations
12. During upgrade from lower versions to VSP 2.9 or Above, follow the below steps:
    1. Enable the checkbox of Enable SSL on the Splunk server
    2. Delete the Splunk configuration from Administration > Configurations in CMS
    3. Reconfigure the Splunk information in CMS

Splunk Configuration in CMS

A super admin can add information related to Splunk server as below:

1. Navigate to Administration > Configurations in the left navigation pane
2. Enable forwarding to Splunk and provide the IP Address, Port number, username and password
3. Click CONNECT