Authentic8 Silo Add-on for Splunk
Overview
Details
The add-on collects and correlates all logged data from one or more Silo Organizations, allowing you to consume the data using the Splunk® Enterprise Security app or any app you create for your SOC or IT requirements. A list of all log types supported is provided in the details page.
Authentic8 Silo Add-on for Splunk® is compatible with all versions of Silo for Safe Access and Silo for Research.
NOTE: You will need to install the 3 dependencies that are specified below before installing the Add-on. If this is not done, the Add-on might not install correctly and cause issues.
- libgmp-dev
- libmpfr-dev
- libmpc-dev
NOTE: Due to required dependencies, we do not currently support Splunk Enterprise running on Windows.
This Add-on (TA) only works with on-premise Linux deployments of Splunk Enterprise and can be installed on a search head, indexer, forwarder, or single instance Splunk server. The add-on also works with Splunk Enterprise Security App as well as customer developed Splunk Apps. If you plan on using this add-on with Splunk's CIM, please make sure the CIM Package is installed.
Installation Guide
- Follow the Installation Guide for step by step instructions on how to fine, setup your environment, install and correctly configure this Add-on. (Please reach out to Authentic8 Support to get a copy of the guide.)
Dependencies
The following libraries need to be installed on the Linux environment prior to installing the add-on as it could cause the add-on to not build correctly and cause a fatal error - Unable to initialize modular input "authentic8" defined in the app "TA-authentic8": Introspecting scheme=authentic8: script running failed (exited with code 1)..
- sudo apt-get install libgmp-dev
- sudo apt-get install libmpfr-dev
- sudo apt-get install libmpc-dev
NOTE: Due to required dependencies, we do not currently support Splunk Enterprise running on Windows.
Support
- If you need support, please check the Authentic8 support page or reach out to us at support@authentic8.com.
Products Supported
Silo Log Types Supported
- URL
- DOWNLOAD
- UPLOAD
- SESSION
- AUTH (authentication logs for Silo session ONLY)
- ADMIN_AUDIT
- LOCATION CHANGE
- BLOCKED URL
- TRANSLATION
- A8SS (Secure Storage)
- HARVEST (covers both Harvester and Collector use)
- ENC (Log type if Log Encryption is Enabled)
Authors
Authentic8
Release Notes
Version 1.0.1
Version 1.0.1
- Changed Add-on Icons
- Minor improvements and fixes
Version 1.0.0
Authentic8 Log Extraction Integration