administrator, or whatever you have created or been assigned). The required credentials are what you would use to login to the support portal on the website or Splunkbase and is not your Splunk Enterprise instance account login (e.g. Within the presented dialog box, login with your credentials to install the app.

The process will be slightly different between Splunk Cloud and Splunk Enterprise. Press the green Install button for the InfoSec App for Splunk.Log the installation of this app within the same request. One of the supporting apps (The Common Information Model CIM app) also needs to be installed through a support request.

Request that the app is installed on the Search Head. Within Splunk Cloud, the InfoSec app cannot be self-installed and requires a support request to be raised through Splunk’s Support Portal. The InfoSec App for Splunk should be listed as one of the available apps for installation. Within the search menu on the top-left of the page, search for infosec app for splunk.The InfoSec app should not be installed onto the IDM.įrom within the Splunk web interface, select the App menu within the black menu bar at the top left of the user interface (just to the right of the Splunk logo). If you’re going to bring in Microsoft365, AWS or other cloud service data sources into your Splunk environment, you’ll need to install technology Add-ons onto the IDM through a support request. It is a heavy forwarder that Splunk provides to assist with the collection of event data from cloud-based services like AWS, Azure, etc. This is an ‘Inputs Data Manager (IDM)’. Log into this instance to perform the installation. This instance is your primary Splunk environment and is where you should install the InfoSec app. Splunk will have supplied you with two instances: If you are a Splunk Cloud customer and are new to using Splunk Cloud. Log into your Splunk environment with an account that has administrative privileges. If there is a difference within the steps. The method for installing the InfoSec app will vary slightly between Splunk Enterprise and Splunk Cloud. Start Splunk Enterprise for the first timeĪ short introductory video to using the Splunk web interface Installing Splunk on Windows documentation. Installing Splunk on Linux documentation. If you need to do this before proceeding further, please view the following resources: This document does not cover installing and configuring Splunk for the first time. It’s assumed that you already have Splunk installed somewhere, or you’re using Splunk Cloud.

Installing the app and pre-requisites should take less than 15 minutes. The InfoSec app for Splunk can be installed directly into Splunk in the same way as other available apps from Splunkbase.

Install splunk enterprise