Splunk Enterprise app installation guide
Getting started
Section titled “Getting started”Install the DomainTools App on a search head or within a search head cluster. A search head is a Splunk component that handles search requests and presents results to users. DomainTools tests this app against the recommended Splunk deployment model for apps in a clustered environment, including distributed configuration.
Review the Splunk docs on app installation and configuration in a clustered environment. See use the deployer to distribute apps and configuration updates.
After configuration, wait 10-15 minutes for the enrichment process to start populating the dashboards. Enrichment adds threat intelligence data to your domain observations. The app enriches new events every 5 minutes by default.
Prerequisites
Section titled “Prerequisites”- Splunk Enterprise Security (ES) or Splunk (non-ES).
- DomainTools API key access to the products you plan to use — see Authentication for credential setup.
- Iris Enrich and Iris Investigate access enables the corresponding enrichment and investigation workflows.
- You need Real-time Threat Feeds access for the corresponding domain and IP feed search commands.
- Firewall and networking
- Splunk must be able to reach
api.domaintools.com.
- Splunk must be able to reach
- Splunk credentials and permissions
- You need a Splunk account with
adminaccess to install and configure the app - After installation, most user functions should be available with less privileged accounts
- The user account operating the app needs the
list_storage_passwordsprivilege - You may need the admin role to access Splunk’s password storage
- You need write privileges to update internal stores; for the list of KV stores and descriptions, consult the KV store names table
- You need a Splunk account with
- Prior Versions Uninstalled
- Uninstall any prior 3.x or 4.x versions of the DomainTools App and perform a fresh installation
- For best results, use the Splunk web UI to uninstall previous versions, and then remove any remaining DomainTools folders (for example,
/opt/splunk/etc/apps/ $ rm -rf DomainTools-App-for-Splunk/)
Install the DomainTools App
Section titled “Install the DomainTools App”The latest app is available on Splunkbase.
Install the app using Splunk’s standard process for your deployment type. Follow the official Splunk documentation so your steps stay current with the Splunk platform:
- Splunk Cloud: The DomainTools App is vetted and available for Splunk Cloud. Install directly from Splunkbase using the self-service app installation process.
- Single-instance Splunk Enterprise: See Install an add-on in a single-instance Splunk Enterprise deployment.
- Distributed or clustered Splunk Enterprise (on-premise): See Install an add-on in a distributed Splunk Enterprise deployment. For a search head cluster, use the deployer to distribute the app to the cluster members.
Install the DomainTools App on your search head or search head cluster members. You don’t need to install it on your indexers or indexer cluster.
Restart Splunk after installation or upgrade
Section titled “Restart Splunk after installation or upgrade”After every fresh installation or upgrade of the DomainTools App, restart Splunk before configuring or using the app. A restart is required even if Splunk doesn’t prompt you to restart. Follow the restart procedure for your Splunk deployment.
Next steps
Section titled “Next steps”After restarting Splunk, configure the app:
- DT Settings - Configure your base search and saved searches