Installation and Configuration

Prerequisites

Because this App runs on Splunk Enterprise, all the Splunk Enterprise system requirements apply.

This app depends on data models included in the Splunk Common Information Model Add-on, specifically the Authentication data model. Please review the information on configuring the acceleration on the data model.

The Splunk Common Information Model Add-on can be downloaded from Splunkbase.

This app has been tested with versions 4.8 of the CIM add-on.

In order to make the app respond and load quickly, accelerated data models are used to provide summary data. For this data to be available, the Authentication data model must be accelerated. Information on how to enable acceleration for the Authentication data model can be found here. The data model must be accelerated for the length of time for which you would like to see reporting.

The Breakdown of Sourcetypes in Indexes in Dataset panel on the Data Transparency Overview dashboard will only be seen if the Sankey Diagram visualization is installed.

The Sankey Diagram Visualization can be downloaded from Sankey Diagram Custom Visualization.

Lookups

PAVO Authentication App for Splunk contains the following default lookup files.

apl_aut_default_users.csv
apl_aut_priv_users.csv

We strongly suggest that if you want to use customized versions of the lookups, you create new configurations for additional lookups, rather than editing the .csv files included in the app. Splunk lookup files are not upgrade safe, so future versions of the app may contain lookup files which may overwrite your customizations.

Macros

There are two macros which may be customized to help this app fit into your environment, and make use of other lookups (possibly the ones from the Splunk App for Enterprise Security). In both of these cases, the result is that the search in the macro should output a user field which contains the users appropriate for your environment.

apl_aut_default_users_lookup

Used for the Default Authentication dashboard. By default, uses the apl_aut_default_users.csv file. This list was put together from multiple sources, and may not contain all the default users which may be available in your environment.

apl_aut_priv_users_lookup

Used for the Privileged Authentication dashboard. By default, uses the apl_aut_priv_users.csv file. This list was put together from multiple sources, and may not contain all the privileged users which may be available in your environment.

References and Downloads

Installation and Configuration

Reminder: This app should be installed on a search head where the Authentication data model has been accelerated. More information on installing or upgrading Splunk apps can be found here.

Download

Download PAVO Authentication App for Splunk at https://splunkbase.splunk.com/app/4227.

Installation Process Overview

Make sure the field extractions and tags on your authentication events are correct.
Install the Splunk Common Information Model Add-on (skip if you are installing on an ES search head).
Install the Authentication App for Splunk.
Enable accelerations on the Authentication data model (skip if you are installing on an ES search head).
Wait for the accelerations to start. After the acceleration searches have run, you should start seeing the dashboards populate.

Deploy to single server instance

Follow these steps to install the app in a single server instance of Splunk Enterprise:

Deploy as you would any App, and restart Splunk.
Configure.

Deploy to Splunk Cloud

Have your Splunk Cloud Support handle this installation.

Deploy to a Distributed Environment

For each Search Head in the environment, deploy a copy of the App.

PAVO Authentication App for Splunk

0