Install and deploy add-ons

The Splunk Enterprise Security installation includes a selection of add-ons designed for compliance with the Common Information Model (CIM). Add-ons are specific to a single technology, or version of a technology, and provide the knowledge necessary to incorporate that source data into Enterprise Security.

Add-ons provided with Enterprise Security

Splunk Add-on for Blue Coat ProxySG	Splunk Add-on for Bro IDS	Splunk Add-on for McAfee	Splunk Add-on for Juniper
Splunk Add-on for Microsoft Windows	Splunk Add-on for Nessus	Splunk Add-on for NetFlow	Splunk Add-on for Oracle Database
Splunk Add-on for OSSEC	Splunk Add-on for RSA SecurID	Splunk Add-on for Sophos	Splunk Add-on for FireSIGHT
Splunk Add-on for Symantec Endpoint Protection	Splunk Add-on for UEBA	Splunk Add-on for Unix and Linux	Splunk Add-on for Websense Content Gateway
TA-airdefense	TA-alcatel	TA-cef	TA-fireeye
TA-fortinet	TA-ftp	TA-ncircle	TA-nmap
TA-tippingpoint	TA-trendmicro

For configuration details on an add-on that does not have web-based documentation, see the README file included in the root of the add-on's folder.

Distributed installation of add-ons

Add-ons contain pre-defined knowledge about data sources. When you install Splunk Enterprise Security in a distributed environment, add-ons must be distributed based upon the Splunk instance types used in your Splunk environment.

Splunk instance type	Supported	Comments
Search Heads	Yes	Add-ons are installed on the search head with Splunk Enterprise Security. Any unused add-ons should be disabled.
Indexers	Yes	An add-on that includes index-time props and transforms must be deployed to the indexers. For configuration details on an add-on that does not have web-based documentation, see the README file included in the root of the add-on's folder.
Heavy Forwarders	Yes	An add-on that includes index-time props and transforms must be deployed to a heavy forwarder if the data source is routed or collected with that forwarder.
Universal Forwarders	Yes	Most add-on's includes input settings specific to a data source. Review the inputs.conf included with an add-on and deploy the add-on to a forwarder as necessary.
Light Forwarders	Yes	The same considerations as a universal forwarder.

Determine which add-ons to deploy

When you install Splunk Enterprise Security in a distributed environment, the add-ons are installed and enabled on the search head. Add-ons contain search-time knowledge imported during the ES installation, and can include additional index-time operations. An add-on can remain solely on the search head unless it includes additional index-time operations, in which case you must deploy the add-on to your indexers.

1. Review the README files included with each add-on to determine if the add-on includes index-time operations.
2. Collect the add-ons that use index-time operations. Optionally, use the Distributed Configuration Management feature of ES to create an add-on for deployment.
3. Determine how to deploy the add-ons based on the Splunk platform architecture in your environment:

• Non-clustered indexers

1. Place the add-ons on the deployment server.
2. Use the deployment server to deploy the add-on(s) to the indexers. See Plan a deployment in the Updating Splunk Enterprise Instances Manual.

• Clustered indexers

1. Place the add-ons on the cluster master.
2. Use the cluster master to deploy the add-on(s) to the cluster peers. See Manage app deployment across all peers in the Managing Indexers and Clusters of Indexers Manual.

Distributed deployment compatibility

Distributed deployment feature	Supported	Comments
Search Head Clusters	Yes	Use the search head cluster deployer to distribute add-ons across search head cluster members. See Installing Add-ons on a Search Head cluster in this topic.
Indexer Clusters	Yes	Use the cluster master to distribute add-ons across a set of index cluster peers . See Manage common configurations across all cluster peers and Manage app deployment across all cluster peers in the Managing Indexers and Clusters Manual.
Deployment Server	Yes	Use the deployment server to distribute add-ons across non-clustered indexers and forwarders.

Creating the Splunk_TA_ForIndexers

1. On the Enterprise Security menu bar, browse to Configure > General and select Distributed Configuration Management.
2. Select the option to Download the Package to merge all indexes.conf and index-time props.conf and transforms.conf settings from all enabled apps and add-ons on the search head, and place them into one add-on for download. The merge creates one indexes.conf, props.conf, and transforms.conf file containing all settings, similar to a ./splunk cmd btool <conf_file_prefix> list output.
3. After the add-on is downloaded, review indexes.conf and update it if needed to conform with site retention settings and other storage options. Optionally, you can remove the indexes.conf file from the add-on as the index configurations for your environment might be configured and managed in another app. For more information on configuring the indexes for Enterprise Security, see Configure and deploy Indexes in this manual.

When you install a new add-on for use with ES, create an updated copy of Splunk_TA_ForIndexers by returning to the Distributed Configuration Management page and selecting Download the Package.

Automated deployment of the Splunk_TA_ForIndexers

If your Splunk platform installation uses the Deployment Server to manage the indexer settings, you can configure the Distributed Configuration Management page to push the Splunk_TA_ForIndexers directly to the indexers. This feature is designed to work with a Splunk Deployment Server, and cannot be used for indexer clustering.

1. Make the search head a deployment client of the Deployment Server.
2. On the Enterprise Security menu bar, browse to Configure > General and select Distributed Configuration Management.
3. Select Yes for Do you want to use auto deployment?
4. Select Add new credential to create a Splunk administration credential for use with the Deployment Server. The user credential must be in the Splunk administrator role on the Deployment Server instance.
5. Fill out the User and Password fields, and set the Application field to SplunkEnterpriseSecuritySuite.
6. Save the credential.
7. Use the Select credentials drop down to choose the Splunk admin credentials required to authenticate with the Deployment Server
8. Select the indexers that can receive the Splunk_TA_ForIndexers add-on. The indexers list is created from the search head's Distributed search configuration page.
   1. (Optional): You can add additional indexer names manually by entering text in the Select Splunk Indexers field.
9. Select Save to create the Splunk_TA_ForIndexers add-on that includes the index-time props.conf, and transforms.conf.
   1. (Optional): Enable the Push indexes.conf setting. As the index settings often require storage specific configuration, do not choose this option by default.

If you disable the auto-deployment option after enabling it, the Splunk_TA_ForIndexers add-on will remain on the Deployment Server, and you must remove the add-on and serverclass manually.

Installing add-ons on a Search Head

Each add-on is specific to a single technology, or version of a technology, and provides the knowledge necessary to incorporate that source data into Enterprise Security. Use the Splunk Apps manager to add additional CIM-compatible add-ons to your search head. To deploy an add-on to other Splunk instances, see Distributed deployment compatibility in this topic.

Note: Install add-ons that are compatible with the Common Information Model.

Find an add-on

1. Log in to splunk.com.
2. Go to Splunkbase.
3. Browse and search the list of add-ons.
4. Select an add-on.
5. Download the add-on.

Add an add-on from a local file

1. Click Apps next to Splunk in the menu bar.
2. From the drop-down menu, select Manage Apps.
3. Select Install app from file.
4. In the Upload an app panel, browse for the location of the add-on and select it.
5. Click Upload.

Edit an existing add-on

1. Click Apps next to Splunk in the menu bar.
2. From the drop-down menu, select Manage Apps.
3. Select the add-on from the list.
4. Click Edit Properties for the add-on you want to configure.
5. When your finished, click Save.

Note: Do not use the Create app option on the Apps page within Enterprise Security.

Updating add-ons

Some add-ons are released independently of Enterprise Security, and can be downloaded directly from Splunkbase.

Update the add-on from within Splunk

To check for the new version of an app, select Manage Apps on the Apps menu. A link will appear in the Version column if a new version is available.

1. Log in to splunk.com.
2. Click the link in the version column in Splunk Enterprise.
3. Confirm that an updated version of the add-on exists. Click Update to get the new version.
4. To install the add-on, choose Restart.

Update the app manually

1. Log in to splunk.com.
2. Find the new version of the add-on on Splunkbase.
3. Download the add-on to your desktop or local directory.
4. Browse to Apps > Manage Apps > Install app from file.
5. Browse to the add-on location and select the add-on.
6. Select Upgrade app... so that the new version of the add-on overwrites the prior version.
7. Choose Upload.
8. To install the add-on, choose Restart.

Installing add-ons on a search head cluster

Using search head clustering changes the process for deploying apps and configuration files to the search head cluster members. To distribute app and add-on configurations across a set of search head cluster members, you must use the search head cluster deployer.

Distributing add-ons in a search head cluster with Splunk Enterprise 6.4

App import settings automatically replicate across search head cluster nodes running Splunk Enterprise 6.4 or later. Use the search head cluster deployer to distribute add-ons across the set of search head cluster members. For details, see Use the deployer to distribute apps and configuration updates in the Splunk Enterprise Distributed Search Manual.

Distributing add-ons in a search head cluster with Splunk Enterprise 6.3.x

If you use Splunk Enterprise 6.3.x, all add-ons must be placed onto the staging instance and imported before moving the contents of Splunk Enterprise Security to the deployer.

1. Install the add-ons on to the staging server used for the Enterprise Security installation.
2. Let app_imports_update.py run once on the staging server. Use a search to determine when the script last ran.
   

   index=_internal source="*python_modular_input.log" file="app_imports_update.py*" "Meta-data updated" | stats latest(_time) by input | `uitime(latest(_time))`

3. Copy the contents of the etc/apps directory on the staging server to the etc/shcluster/apps directory on the search head cluster deployer.
4. Deploy the configurations.

Import custom apps and add-ons

You can extend the functionality of Splunk Enterprise Security with apps and add-ons. Download apps and add-ons from Splunkbase or create your own add-on with a tool such as the Splunk Add-on Builder.

Use the Update ES modular input

Splunk Enterprise Security imports apps and add-ons that match a regex filter with the Update ES modular input. The regex filter is defined in inputs.conf.

Modular input	Function
app_imports_update://update_es	Imports and updates the metadata for supporting add-ons.
app_imports_update://update_es_da	Imports and updates the metadata for domain add-ons.
app_imports_update://update_es_main	Imports and updates the metadata for the SplunkEnterpriseSecuritySuite.

Imports are transitive

App imports are transitive. This means than an app (A) that imports another app (B), also imports all of the apps (C) imported by that app.

1. If app A imports B,
2. and app B imports C,
3. then A imports C.

Because supporting add-ons import each other, you might see only one supporting add-on with an updated local.meta file. This is SA-AccessProtection, as it is the first supporting add-on in the list of apps.

View existing app imports

View the existing app imports by using rest search commands. You must have Splunk administrator permissions to run the command.

For example, view the imports for the SplunkEnterpriseSecuritySuite app.

| rest /servicesNS/<username>/system/apps/local/SplunkEnterpriseSecuritySuite/import splunk_server=local | fields import

App and add-on import naming conventions

The modular inputs will automatically import apps and add-ons prefixed with any of the following: DA-ESS-, SA-, TA-, Splunk_SA_, Splunk_TA_, and Splunk_DA-ESS_.

Import add-ons with a different naming convention

If you create a custom add-on that uses a different naming convention, you need to add that naming convention to ES to import your add-on. Add a custom naming convention in the inputs.conf file used by the modular input.

1. Open the $SPLUNK_HOME/etc/apps/SplunkEnterpriseSecuritySuite/local/inputs.conf file.
2. Edit or create the [app_imports_update://update_es] stanza.
3. Edit or create the app_regex = field.
4. Add the naming convention of your add-on to the list of supported naming conventions using regex.
5. Save the file.
6. Preview the changes

   | rest services/data/inputs/app_imports_update | table title app_regex

7. Click Restart to incorporate the changes.

For example, add an add-on named ME_datasource.

[app_imports_update://update_es]
app_regex = (appsbrowser)|(search)|([ST]A-.*)|(Splunk_([ST]A_.*)|(DA-ESS-.*)|(Splunk_DA-ESS_.*)|(ME_datasource)

Note: If you create the app import stanza in your local inputs.conf file, make sure to copy the full regex from the default inputs.conf file or existing app imports will fail.

Remove an add-on from app import

To remove an add-on from app import:

1. Open the $SPLUNK_HOME/etc/apps/SplunkEnterpriseSecuritySuite/local/inputs.conf file.
2. Edit or create the [app_imports_update://update_es] stanza.
3. Edit or create the app_exclude_regex = field.
4. Make the necessary changes using regex and save the file.
5. Click Restart to incorporate the changes.

For example, remove a custom add-on named TA_new_test from the import process:

[app_imports_update://update_es]
app_exclude_regex = TA_new_test

Splunk Stream integration

Enterprise Security offers direct integration with Splunk Stream.

Splunk Stream has two components:

• The Splunk App for Stream is responsible for the job management of the Splunk Stream Add-on. The Splunk App for Stream is installed on the Enterprise Security search head.

• The Splunk Stream Add-on is the listener that siphons data from the network. The Splunk Stream Add-on is installed on forwarders.

Data collection using the Splunk Stream Add-on requires a review and analysis of the network topology to determine the best method and location for data capture. See Network collection architectures in the Splunk Stream User Manual.

Stream data collection utilizes system resources that scale with the number of protocols polled and the volume of network data. See Hardware requirements in the Splunk Stream User Manual.

Splunk Stream communications

Integrating Enterprise Security with Splunk Stream requires the installation of the Stream app on the ES search head. The Splunk Stream Add-on is installed on the forwarders, and initiates communications with the Stream app on the search head over HTTP.

Stream data capture jobs are managed from the Splunk App for Stream, and are retrieved for processing by the Stream Add-on. The Splunk Stream Add-on must be configured to communicate with the Splunk App for Stream. See Configure Stream Forwarder in the Splunk Stream User Manual.

Create a Stream capture job

There are 2 ways to create a Stream capture job from Enterprise Security.

A workflow action

You can use a workflow action to create a Stream packet capture job in any event view in Splunk Enterprise and Enterprise Security that both has an action menu and displays a source or destination IP. The workflow action opens the Create Stream Capture page.

Review the requirements and change them if needed.

• Description: Defaults to the source or destination IP chosen in the workflow action.
• Protocols to capture: Defaults to All. For more information, see Supported protocols in the Splunk Stream Installation and Configuration manual.
• Capture duration: Defaults to 7 days.

Choose Create Capture to finish and create a job for Splunk Stream.

Note: If Splunk Stream is not installed, a warning and a link to the app is displayed.

To view and analyze the Stream data events captured, see the Protocol Intelligence dashboards in the Enterprise Security User Manual.

A correlation search alert action

A correlation search can initiate a Stream capture job as an alert action. See Configure correlation search actions in Enterprise Security User Manual.