Install and deploy add-ons

The Splunk Enterprise Security installation includes a selection of add-ons designed for compliance with the Common Information Model (CIM). Add-ons are specific to a single technology, or version of a technology, and provide the knowledge necessary to incorporate that source data into Enterprise Security.

Add-ons provided with Enterprise Security

"Splunk Add-on for Blue Coat ProxySG"	"Splunk Add-on for Bro IDS"	"Splunk Add-on for McAfee"	"Splunk Add-on for Juniper"
"Splunk Add-on for Microsoft Windows"	"Splunk Add-on for Nessus"	"Splunk Add-on for NetFlow"	"Splunk Add-on for Oracle Database"
"Splunk Add-on for OSSEC"	Splunk Add-on for PaloAlto	"Splunk Add-on for Sophos"	"Splunk Add-on for FireSIGHT"
"Splunk Add-on for Symantec Endpoint Protection"	"Splunk Add-on for Unix and Linux"	TA-airdefense	TA-alcatel
TA-cef	TA-fireeye	TA-fortinet	TA-ftp
TA-ncircle	TA-nmap	TA-rsa	TA-tippingpoint
TA-trendmicro	TA-websense

For configuration details on an add-on that does not have web-based documentation, see the README file included in the root of the add-on's folder.

Distributed installation of add-ons

Add-ons contain pre-defined knowledge about data sources. When you install Splunk Enterprise Security in a distributed environment, add-ons must be distributed based upon the Splunk instance types used in your Splunk environment.

Splunk instance type	Supported	Comments
Search Heads	Yes	Add-ons are required on the search head for any enabled data sources. Any unused add-ons should be disabled.
Indexers	Yes	An add-on that includes index-time props and transforms must be deployed to the indexers. For configuration details on an add-on that does not have web-based documentation, see the README file included in the root of the add-on's folder.
Heavy Forwarders	Yes	An add-on that includes index-time props and transforms must be deployed to a heavy forwarder if the data source is routed or collected with that forwarder.
Universal Forwarders	Yes	Most add-on's includes input settings specific to a data source. Review the inputs.conf included with an add-on and deploy the add-on to a forwarder as necessary.
Lightweight Forwarders	Yes	The same considerations as a universal forwarder.

Determine which add-ons to deploy

When you install Splunk Enterprise Security in a distributed environment, included add-ons are installed and enabled on the search head. Add-ons contain search-time knowledge imported during the ES installation, and can include additional index-time operations. Add-ons can remain solely on the search head unless they include additional index-time operations, in which case you must deploy the add-on to your indexers.

1. Review the README files included with each add-on to determine if the add-on includes index-time operations.
2. Collect the add-ons that use index-time operations. Optionally, use the Distributed Configuration Management feature of ES to create an add-on for deployment.
3. Determine how to deploy the add-ons based on the Splunk platform architecture in your environment:

• Non-clustered indexers

1. Place the add-ons on the deployment server.
2. Use the deployment server to deploy the add-on(s) to the indexers. See "Plan a deployment" in the Updating Splunk Enterprise Instances Manual.

• Clustered indexers

1. Place the add-ons on the cluster master.
2. Use the cluster master to deploy the add-on(s) to the cluster peers. See "Manage app deployment across all peers" in the Managing Indexers and Clusters of Indexers Manual.

Distributed deployment compatibility

Distributed deployment feature	Supported	Comments
Search Head Clusters	Yes	Use the search head cluster deployer to distribute add-ons across the set of search head cluster members,. See "Use the deployer to distribute apps and configuration updates" in the Splunk Enterprise Distributed Search Manual.
Indexer Clusters	Yes	Use the cluster master to distribute add-ons across a set of index cluster peers . See "Manage common configurations across all cluster peers" and "Manage app deployment across all cluster peers" in the Managing Indexers and Clusters Manual.
Deployment Server	Yes	Use the deployment server to distribute add-ons across non-clustered indexers and forwarders.

Creating the Splunk_TA_ForIndexers

1. On the Enterprise Security menu bar, browse to Configure > General and select Distributed Configuration Management.
2. Select the option to Download the Package to merge all indexes.conf and index-time props.conf and transforms.conf settings from all enabled apps and add-ons on the search head, and place them into one add-on for download. The merge creates one indexes.conf, props.conf, and transforms.conf file containing all settings, similar to a ./splunk cmd btool <conf_file_prefix> list output.
3. After the add-on is downloaded, review indexes.conf and update it if needed to conform with site retention settings and other storage options. Optionally, you can remove the indexes.conf file from the add-on as the index configurations for your environment might be configured and managed in another app. For more information on configuring the indexes for Enterprise Security, see "Configure and deploy Indexes" in this manual.

When you install a new add-on for use with ES, create an updated copy of Splunk_TA_ForIndexers by returning to the Distributed Configuration Management page and selecting Download the Package.

Automated deployment of the Splunk_TA_ForIndexers

If your Splunk platform installation uses the Deployment Server to manage the indexer settings, you can configure the Distributed Configuration Management page to push the Splunk_TA_ForIndexers directly to the indexers. This feature is designed to work with a Splunk Deployment Server, and cannot be used for indexer clustering.

1. Make the search head a deployment client of the Deployment Server.
2. On the Enterprise Security menu bar, browse to Configure > General and select Distributed Configuration Management.
3. Select Yes for Do you want to use auto deployment?
4. Select Add new credential to create a Splunk administration credential for use with the Deployment Server. The user credential must be in the Splunk administrator role on the Deployment Server instance.
5. Fill out the User and Password fields, and set the Application field to SplunkEnterpriseSecuritySuite.
6. Save the credential.
7. Use the Select credentials drop down to choose the Splunk admin credentials required to authenticate with the Deployment Server
8. Select the indexers that can receive the Splunk_TA_ForIndexers add-on. The indexers list is created from the search head's Distributed search configuration page.
   1. (Optional): You can add additional indexer names manually by entering text in the Select Splunk Indexers field.
9. Select Save to create the Splunk_TA_ForIndexers add-on that includes the index-time props.conf, and transforms.conf.
   1. (Optional): Enable the Push indexes.conf setting. As the index settings often require storage specific configuration, do not choose this option by default.

If you disable the auto-deployment option after enabling it, the Splunk_TA_ForIndexers add-on will remain on the Deployment Server, and you must remove the add-on and serverclass manually.

Installing add-ons

Each add-on is specific to a single technology, or version of a technology, and provides the knowledge necessary to incorporate that source data into Enterprise Security. Use the Splunk Apps manager to add additional CIM-compatible add-ons to your deployment. You can use pre-packaged add-ons or create your own.

Note: Install only apps or add-ons that state they are compatible with the Common Information Model.

Find an add-on

1. Log in to splunk.com.
2. Go to Splunkbase.
3. Browse and search the list of apps.
4. Select an app to install.

Add an add-on from a local file

1. Click Apps next to Splunk in the menu bar.
2. From the drop-down menu, select Manage Apps.
3. Select Install app from file.
4. In the Upload an app panel, browse for the location of the app and select it.
5. Click Upload.

Edit an existing add-on

1. Click Apps next to Splunk in the menu bar.
2. From the drop-down menu, select Manage Apps.
3. Select the app from the list.
4. Click Edit Properties for the app you want to configure.
5. When you finish, click Save.

Note: Do not use the Create app option on the Apps page with the Enterprise Security app.

Updating add-ons

Some add-ons are released independently of Enterprise Security, and can be downloaded directly from Splunkbase.

Update the app from within Splunk

To check for the new version of an app, select Manage Apps on the Apps menu. A link will appear in the Version column if a new version is available.

1. Log in to splunk.com.
2. Click the link in the version column in Splunk Enterprise.
3. Confirm that an updated version of the add-on exists. Click Update to get the new version.
4. To install the add-on, choose Restart.

Update the app manually

1. Log in to splunk.com.
2. Find the new version of the add-on on Splunkbase.
3. Download the add-on to your desktop or local directory.
4. Browse to Apps > Manage Apps > Install app from file.
5. Browse to the add-on location and select the add-on.
6. Select Upgrade app... so that the new version of the add-on overwrites the prior version.
7. Choose Upload.
8. To install the add-on, choose Restart.

The Update ES modular input

Splunk Enterprise Security functionality is extended through adding apps and add-ons. Enterprise Security includes a modular input responsible for importing apps and add-ons that match a filter.

Modular input	Details
app_imports_update://update_es	Imports and updates the metadata for SA's.
app_imports_update://update_es_da	Imports and updates the metadata for DA's.
app_imports_update://update_es_main	Imports and updates the metadata for the SplunkEnterpriseSecuritySuite.

Imports are transitive

App imports are transitive. This means than an app (A) that imports another app (B), also imports all of the apps (C) imported by that app.

1. If app A imports B,
2. and app B imports C,
3. then A imports C.

Because supporting add-ons import each other, you might see only one supporting add-on with an updated local.meta file. This is SA-AccessProtection, as it is the first supporting add-on in the list of apps.

View current app imports

View the current app imports by using rest search commands. You must have Splunk administrator permissions to run the command.

To view the imports for the SplunkEnterpriseSecuritySuite app:

| rest /servicesNS/nobody/system/apps/local/SplunkEnterpriseSecuritySuite/import splunk_server=local | fields import

Import add-ons with a different naming convention

To add a new add-on naming convention for importing custom apps into ES, modify the inputs.conf file used by the modular input.

1. Open the $SPLUNK_HOME/etc/apps/SplunkEnterpriseSecuritySuite/local/inputs.conf file.
2. Edit or create the [app_imports_update://update_es] stanza.
3. Edit or create the app_regex = field
4. Make the necessary changes using regex and save the file.
5. Click Restart to incorporate the changes.

Example: Adding an app named new_data_source to the update_es stanza:

[app_imports_update://update_es]

app_regex = (search)|([ST]A-.*)|(Splunk_[ST]A_.*)|(DA-ESS-.*)|(Splunk_DA-ESS_.*)|(new_data_source)

Remove an add-on from app import

To remove an add-on from app import:

1. Open the $SPLUNK_HOME/etc/apps/SplunkEnterpriseSecuritySuite/local/inputs.conf file.
2. Edit or create the [app_imports_update://update_es] stanza.
3. Edit or create the app_exclude_regex = field
4. Make the necessary changes using regex and save the file.
5. Click Restart to incorporate the changes.

For example, remove a custom add-on from the import process:

[app_imports_update://update_es]

app_exclude_regex = TA_new_test

Splunk Stream integration

Enterprise Security offers direct integration with "Splunk Stream".

Splunk Stream has two components:

1. The Splunk App for Stream is responsible for the job management of the Splunk Stream Add-on. The Splunk App for Stream is installed on the Enterprise Security search head.

2. The Splunk Stream Add-on is the listener that siphons data from the network. The Splunk Stream Add-on is installed on forwarders.

Data collection using the Splunk Stream Add-on requires a review and analysis of the network topology to determine the best method and location for data capture. See "Network collection architectures" in the Deploy and Use Splunk App for Stream Manual.

Stream data collection utilizes system resources that scale with the number of protocols polled and the volume of network data. See "Hardware requirements" in the Splunk Stream User Manual.

Splunk Stream communications

Integrating Enterprise Security with Splunk Stream requires the installation of the Stream app on the ES search head. The Splunk Stream Add-on is installed on the forwarders, and initiates communications with the Stream app on the search head over HTTP.

Stream data capture jobs are managed from the Splunk App for Stream, and are retrieved for processing by the Stream Add-on. The Splunk Stream Add-on must be configured to communicate with the Splunk App for Stream. See "Configure Stream Forwarder" in the Splunk Stream User Manual.

Create a Stream capture job

There are 2 ways to create a Stream capture job from Enterprise Security.

A workflow action

You can use a workflow action to create a Stream packet capture job in any event view in Splunk Enterprise and Enterprise Security that both has an action menu and displays a source or destination IP. The workflow action opens the Create Stream Capture page.

Review the requirements and change them if needed.

• Description: Defaults to the source or destination IP chosen in the workflow action.
• Protocols to capture: Defaults to All. For more information, see "Supported Protocols" in the Splunk Stream User Manual.
• Capture duration: Defaults to 7 days.

Choose Create Capture to finish and create a job for Splunk Stream.

Note: If Splunk Stream is not installed, a warning and a link to the app is displayed.

To view and analyze the Stream data events captured, see the "Protocol Intelligence dashboards" in the Enterprise Security User Manual.

A correlation search alert action

A correlation search can initiate a Stream capture job as an alert action. See "Configure correlation search actions" in Enterprise Security User Manual.