Install as a virtual machine image

is delivered as a virtual machine image in .OVA format.

The virtual machine image of is for an unprivileged installation, meaning the the application runs under the phantom user account, not as the root user.

• The base installation directory for the unprivileged virtual machine is /opt/phantom/. All files and logs will be located under this directory. For example, log files are in /opt/phantom/var/log/phantom. In the instructions for installing a virtual machine image, <PHANTOM_HOME> represents the /opt/phantom/ directory.
• The user account phantom owns the the install, and should be used to do all operations.
• The custom HTTPS port is 9999, but the web interface is also available on port 443.

Download the virtual machine image from the Community site on the Products page.

For evaluation or test environments, use a hypervisor or virtual machine management application such as VMware Fusion®, VMware Fusion Pro®, VMware Workstation Player®, VMware Workstation Pro®, or Oracle® VirtualBox.

For production environments, use VMware ESXi™ or VMware vSphere® version 5 or higher.

Install with VMware vSphere ESXi or VMware vSphere

These instructions might not be an exact match for the way your VMware vSphere or ESXi products configured. Consult your vSphere administrator or the documentation on the VMware website for more options.

You can use thin provisioning and install VMware Tools with Splunk SOAR (On-premises).

1. Log in to the correct vSphere or vCenter asset.
2. From the File menu, select Deploy OVF Template.
3. Click Browse to locate the downloaded OVA file.
4. Click Next.
5. Fill out the remaining settings options. Consult the VMware documentation on the VMware website or your VMware administrator.
6. Click Finish.

Install with VMware Fusion® or VMware Fusion Pro®

For more detailed information on installing virtual machine images, consult the VMware Fusion or VMware Fusion Pro documentation.

1. Open VMware Fusion or VMware Fusion Pro.
2. From the File menu, select New.
3. Click More options.
4. Click Import an existing virtual machine.
5. Click Choose File. Navigate to the OVA file.
6. Click Open.
7. Follow the remaining prompts to launch the virtual appliance.

Install with VMware Workstation Pro®

For more detailed information on installing virtual machine images, consult the VMware Workstation Pro documentation.

1. Open VMware Workstation Pro.
2. Click Open a Virtual Machine.
3. Navigate to the OVA file.
4. Click Open.
5. Type a name and storage path for the virtual appliance.
6. Click Import.
7. Click Power on this virtual machine.

Install with VMware Workstation Player®

For more detailed information on installing virtual machine images, consult the VMware Workstation Player documentation.

1. Open VMware Workstation Player.
2. Click Open a Virtual Machine.
3. Navigate to the OVA file.
4. Click Open.
5. Type a name and storage path for the virtual appliance.
6. Click Import.
7. Click Play virtual machine.

If you are prompted to connect additional devices, such as sound cards or USB ports to the virtual machine, decline.

Install with Oracle® VirtualBox

For more detailed information on using Oracle VirtualBox to run virtual machine images, consult the VirtualBox end-user documentation on VirtualBox.org.

1. Start Oracle VirtualBox.
2. From the File menu, select Import Appliance.
3. Select the folder icon to navigate to the OVA.
4. Click Open.
5. Click Continue.
6. Click base_vm_centos_7.
7. Click Start.

Complete the OVA install

These steps must be completed after the virtual appliance has been installed in your virtual machine manager. will generate a self-signed SSL certificate when it launches for the first time.

Set system passwords

You must set a new password for the user account phantom. The user account phantom has SSH and sudo permissions.

1. SSH to the instance's operating system with the user account phantom. The default password is 'password', and it must be changed immediately.
2. Set a new password for the phantom user account using the command passwd phantom.

More information about passwords and user accounts:

• SSH is disabled for the root user.
• The password for the root user has been set to a randomly generated string. If you want to set the password to a known value, use the phantom user account, and run the command sudo passwd root.
• You may remove sudo access from the phantom user account. If you choose to do that, you must create another user account that has NOPASSWD sudo access.

Configure the network settings for the virtual machine

The virtual machine requires a static IP address for production environments. In a test environment, you can use DHCP.

1. SSH to the instance with the user account phantom.
   ssh phantom@< hostname or IP address>
2. Elevate to root.
   sudo su -
3. Edit the file /etc/sysconfig/network-scripts/ifcfg-ens160. The file has these default settings:

   TYPE=Ethernet
   ONBOOT=yes
   BOOTPROTO=dhcp
   NM_CONTROLLED=NO
   DEVICE=ens160

   Change the BOOTPROTO and add entries for IPADDR, NETMASK, and GATEWAY. Your finished file should look like this:

   TYPE=Ethernet
   ONBOOT=yes
   BOOTPROTO=static
   NM_CONTROLLED=NO
   DEVICE=ens160
   IPADDR=<static_ip>
   NETMASK=<netmask>
   GATEWAY=<gateway>
   
   

4. Add name servers to your network configuration in /etc/resolv.conf.

   echo "nameserver <nameserver_ip>" >> /etc/resolv.conf

5. Restart networking on the virtual machine.

   systemctl restart network

The custom HTTPS port for unprivileged OVA or AMI based installations is TCP port 9999. However, the UI is still accessible on TCP port 443.

Next step: log in to verify the installation

You can log in to the web interface after the setup script completes to configure user accounts and additional settings. See Log in to the web interface.