Installation and Configuration Steps

This application can be installed an On-Prem or Cloud deployments of Splunk.

Installation Steps for `on-prem`

Install the TA on one of the Heavy Forwarder(s). Ensure to copy over eventtypes.conf, props.conf and tags.conf over to your search head to make sure field aliases, event types and tags for data model mapping comes through.

Installation Steps for `cloud`

Create a support ticket with APP-CERT reference to get the app installed on a Cloud instance OR follow the cloud-ops recommended set of actions to install non-published applications.

Configuration steps

The configuration steps are common for on-prem and cloud. Please follow the following steps in order:
1. Create a new index called zeronetworks_audit.
2. Open the Web UI for the Heavy Forwarder (or IDM).
3. Navigate to the Zero Networks Add on for Splunk from the Manage Apps Section.
4. Navigate to the Inputs tab.
5. Click on ZeroNetworksAudit input.
6. Enter the following details:
- Name (required): Provide a unique name for the input.
- Interval (required): Provide a number in seconds for the query interval. Reccommended to leave as default
- Index (required): Select the index from the dropdown list. Set the default index to be zeronetworks_audit.
- APIKey (required): Enter the APIKey retrieved from the Zero Networks portal see APIKey Generation below.
- Start Time (required): Enter the time from which to begin querying, in the format 0000000000000 (epoch milliseconds). The default has been set to 0000000000000.
7. Click on Update to save the input.
8. To check for any logs or errors, navigate to the Search tab and enter the below search index=_internal source="*ta_zeronetworks_add_on_for_splunk_*.log".

APIKey Generation - Authentication Step

Login to the Zero Networks Portal
Go to Settings.
Click API under Integrations.
Click Add new token.
Enter the following details:
Token Name: Splunk Add-on
Access Type: Read-only
Expiry: 36 Months
Click Add.
Copy the generated token.
Set a reminder to get a new token and update the app in 35 months.