Installation And Configuration

Prerequisites

Because this App runs on Splunk Enterprise, all the Splunk Enterprise system requirements apply.

This app depends on data models included in the Splunk Common Information Model Add-on, specifically the Network Traffic data model. Please review the information on configuring the acceleration on the data model.

The Splunk Common Information Model Add-on can be downloaded from Splunkbase.

This app has been tested with versions 4.9 of the CIM add-on.

In order to make the app respond and load quickly, accelerated data models are used to provide summary data. For this data to be available, the Network Traffic data model must be accelerated. Information on how to enable acceleration for the Network Traffic data model can be found here. The data model must be accelerated for the length of time for which you would like to see reporting.

The Breakdown of Sourcetypes in Indexes in Dataset panel on the Data Transparency Overview dashboard will only be seen if the Sankey Diagram visualization is installed.

The Sankey Diagram Visualization can be downloaded from Sankey Diagram Custom Visualization.

This app may require some configuration before it will work properly (outside the configuration of the Data Model Acceleration). In particular, you may need to edit the configuration macros, as well as the lookup which populates the Device dropdown found on many of the dashboards.

network_traffic_dvcs

This macro contains the search which is used to populate the Devices dropdown found on many of the dashboards. By default this is the auto-generated lookup, however, the macro can be edited to point to another lookup as needed.

network_traffic_dest_external

This macro contains a partial search which determines when a network traffic events destination IP address is external to your network. By default this will exclude private IP addresses, but can be edited to reflect your own network configuration.

<div class="note"> This search snippet is used in searches using the accelerated data models and the `tstats` command. While the normal SPL does support CIDR, `tstats` does not. Make sure your search syntax will work with the `tstats` command. </div>

network_traffic_src_external

This macro contains a partial search which determines when a network traffic events source IP address is external to your network. By default this will exclude private IP addresses, but can be edited to reflect your own network configuration.

<div class="note"> This search snippet is used in searches using the accelerated data models and the `tstats` command. While the normal SPL does support CIDR, `tstats` does not. Make sure your search syntax will work with the `tstats` command. </div>

For the Device dropdown, present on many of the dashboards, you can use the auto-generated lookup, which runs every morning at 2 am. If your Network Traffic data model is populated, you can run the saved search network_traffic_dvc_auto_gen to populate the dropdown. The lookup has two fields: dvc and device_name. device_name can be a description of the device. dvc can be wild-carded (not CIDR, as that is not available in tstats searches used with the accelerated data models). The search used to populate this dropdown can be configured using the network_traffic_dvcs macro.

References

Splunk Common Information Model Add-on Docs
Splunk Common Information Model add-on Network Traffic data model https://docs.splunk.com/documentation/CIM/latest/user/NetworkTraffic
Splunk Common Information Model Add-on
Sankey Diagram Custom Visualization

Installation and Configuration

Reminder: This app should be installed on a search head where the Network Traffic data model has been accelerated. More information on installing or upgrading Splunk apps can be found here.

Download

Download PAVO Network Traffic App for Splunk at https://splunkbase.splunk.com/app/4229.

Installation Process Overview

Make sure the field extractions and tags on your network traffic events are correct.
Install the Splunk Common Information Model Add-on (skip if you are installing on an ES search head).
Install the PAVO Network Traffic App for Splunk for Splunk.
Enable accelerations on the Network Traffic data model (skip if you are installing on an ES search head).
Wait for the accelerations to start. After the acceleration searches have run, you should start seeing the dashboards populate.
Restart Splunk.
Continue with App Configuration.

Deploy to single server instance

Follow these steps to install the app in a single server instance of Splunk Enterprise:

Deploy as you would any App, and restart Splunk.
Configure.

Deploy to Splunk Cloud

Have your Splunk Cloud Support handle this installation.

Deploy to a Distributed Environment

For each Search Head in the environment, deploy a copy of the App.

PAVO Network Traffic App for Splunk

0