IMPORTANT: PREREQUISITES

At a minimum, you should have data from the following security sources collected by your Splunk environment:
- Firewall data like Cisco ASA, Palo Alto Networks, Check Point, Juniper, Fortinet, etc.
- Active Directory security logs (make sure that your audit policy enables logging failed and successful authentication attempts)
- Antivirus/Malware data like McAfee, Symantec, Trend Micro, etc.
The following free Splunk Add-ons must be installed before you can start using InfoSec App:
- Splunk Common Information Model (CIM): https://splunkbase.splunk.com/app/1621/
- Punchcard visualization: https://splunkbase.splunk.com/app/3129/
- Force Directed visualization: https://splunkbase.splunk.com/app/3767/ (use add-on version 3.0.1 in Splunk Cloud)
- Lookup File Editor: https://splunkbase.splunk.com/app/1724/ (new requirement starting from InfoSec v1.5)
- Sankey Diagram visualization: https://splunkbase.splunk.com/app/3112/ (new optional prerequisite for the experimental VPN Access dashboard starting from v1.5.3)
The following Data Models must be accelerated:
- Authentication
- Change (for app version 1.6.x and newer) or Change Analysis (for app version 1.5.3 and older)
- Intrusion_Detection
- Malware
- Network_Sessions
- Network_Traffic
- Endpoint
- Web (new requirement starting from InfoSec v1.5)
All data used by InfoSec app must be Common Information Model (CIM)-compliant. The easiest way to accomplish that is to use CIM-compliant Splunk Add-ons for your security data sources

WHERE TO INSTALL THE APP

The app can be installed on a standalone Splunk server, a Search Head or a Search Head Cluster. In a distributed environment do not install the app on Indexers; the app should only be installed on Search Head(s).

INFOSEC APP DOCUMENTATION

https://docs.splunk.com/Documentation/InfoSec