JupiterOne App for Splunk

OVERVIEW

The JupiterOne App uses the data that are indexed in Splunk via add-on for Data Visualization. The JupiterOne App for Splunk will provide the below dashboard:
- J1 Alerts
Author - JupiterOne, Inc.
Version - 1.2.0

Browser: Google Chrome, Mozilla Firefox
OS: Platform independent
Splunk Enterprise version: 8.0.X, 8.1.X, 8.2.X
Supported Splunk Deployment: Splunk Cluster, Splunk Standalone and Distributed Deployment

Because this App runs on Splunk Enterprise, all of the Splunk Enterprise system requirements apply.

This app has been distributed in two parts.
- JupiterOne Add-on for Splunk: It collects data from JupiterOne platform.
- JupiterOne App for Splunk: It is used for visualizing JupiterOne data.
This app can be set up in two ways:
- Standalone Mode:
  - Install the JupiterOne App for Splunk and JupiterOne Add-on for Splunk.
  - The JupiterOne App for Splunk uses the data collected by JupiterOne Add-on for Splunk and builds the dashboard on it.
- Distributed Environment:
  - Install the JupiterOne App for Splunk and JupiterOne Add-on for Splunk on the search head. The user only needs to configure an account in JupiterOne Add-on for Splunk but should not create data input.
  - User needs to manually create an index on the indexer (No need to install JupiterOne App for Splunk or JupiterOne Add-on for Splunk on indexer).

The App does not require any specific configuration to make but in case of customized configuration of the JupiterOne Add-on for Splunk, the configuration of App has to be changed.

No special steps are required to upgrade the JupiterOne App for Splunk from version 1.1.0 to version 1.2.0

No special steps are required to upgrade the JupiterOne App for Splunk from version 1.0.0 to version 1.1.0

If the user has selected a default index (Note: By default, Splunk considers only main index as default index) in "Data Input" configuration during JupiterOne Add-on for Splunk's configuration step, then no need to perform this step. But if the user has given any other index in "Data Input" configuration, then perform the following steps:

Go to "Settings" > "Advanced search" > "Search macros".
Select "JupiterOne App for Splunk" in "App" context dropdown.
Click on jupiterone_get_index macro from the shown table.
In the macro definition default value will be index="main". Update the definition with the index you used for data collection and save the configurations. For example: index="<your_index_name>".

Some of the components included in JupiterOne App for Splunk are licensed under free or open source licenses. We wish to thank the contributors to those projects.
Underscore JS
- version: 1.6.0
- URL: http://underscorejs.org
- LICENSE: https://github.com/jashkenas/underscore/blob/master/LICENSE