INSTALLATION SUMMARY

To use the Cb Protection App for Splunk, you must configure the Cb Protection Server for data output, and make modifications on both the system hosting the Cb Protection Server and on the Splunk server. The summary of these steps is as follows:

A. Configure your Cb Protection server to export data.

B. Enable your Splunk server to collect Cb data.

C. Install the Cb Protection app on your Splunk server.

D. If you have additional indexers beyond your Splunk server, install the Cb Protection app on those indexers.

E. Install the Splunk Universal Forwarder on your Cb Protection server machine to send the logs to Splunk.

F. Install the Cb Protection app on your Splunk Universal Forwarder to inform it where the Cb Protection data export is located.

INSTALLATION STEPS

A. Cb Protection Server Configuration

1. On the Cb Protection console menu, choose Administration > System Configuration and click on the External Analytics tab.
2. Click on the Edit button at the bottom of the page.
3. In the General panel, check the Enable Export box.
4. In the Export Directory field, enter the name of the directory into which you want the Cb Protection data to be exported. This directory should be local to your Cb Protection server.
5. Check the boxes next to the kind of data you wish to export in the Messages area: File Catalog, File Operations and Events.
6. Click the Set Analytics URLs to Splunk defaults button to fill in the Analytics Server fields with the proper values for connecting your Cb Protection Console to Splunk. Replace server in the Root URL field with the address of your Splunk Web server.
7. Click Update.

B. Configuring the Splunk Server for Cb Protection Access

You must complete several procedures on the Splunk Server to enable use of Cb Protection data. First, configure the Splunk server to receive forwarder data on port 9997.

1. Log into the Splunk server as an administrator-level user.
2. In the menu bar at the top of the Splunk console, choose Settings (Splunk 6) or Management (Splunk 5), then choose Data > Forwarding and receiving, and in the Forwarding and receiving window, choose Configure receiving.
3. In the Receive data window, check to see whether port 9997 is configured. If not, click the New button, enter 9997 as the port to listen on, and click the Save button.
4. In your firewall, create a rule to ensure that the Splunk server can receive data on port 9997.

C. Install the Cb Protection App on the Splunk Server

1. Log into the Splunk server as an administrator-level user.
2. Copy the file cb-protection-app-for-splunk_20.tar.gz to a convenient location on the server.
3. In the menu bar at the top of the the Splunk console, choose Apps > Manage Apps.
4. Install the app from its zip file: Click on Install app from file and in the Upload an app dialog, browse to the cb-protection-app-for-splunk_20.tar.gz file. and then click Upload.

D. Install the Cb Protection App on your additional Splunk indexers

1. Copy the cb-protection-app-for-splunk_20.tar.gz file you downloaded to the \etc\apps subdirectory under the Splunk indexer installation directory. For example, if you are running a 64-bit OS on the Splunk indexer machine: C:\Program Files\Splunk\etc\apps\
2. Unzip and untar the file.
3. At a command prompt, restart the Splunk indexer:

cd \Program Files\Splunk\bin

.\splunk restart

E. Install the Splunk Universal Forwarder on the Cb Protection Server

1. Download the Splunk Universal Forwarder from the Splunk website: http://www.splunk.com/download/universalforwarder
2. Run the appropriate installer for your operating system on the Cb Protection Server
3. Provide the address of your Splunk server (or indexer, if you have one) when prompted.

Important

During the Splunk Universal Forwarder installation process, do not enter the location of the data files on the Cb Protection Server when prompted. The location of these files will be provided by the Cb Protection App for Splunk.

F. Install the Cb Protection App on the Splunk Universal Forwarder

Once the Splunk Universal Forwarder is installed, install the Cb Protection under the Splunk Universal Forwarder installation directory:

1. Copy the cb-protection-app-for-splunk_20.tar.gz file you downloaded to the \etc\apps subdirectory under the Splunk Universal Forwarder installation directory. For example, if you are running a 64-bit OS on the Cb Protection Server: C:\Program Files\SplunkUniversalForwarder\etc\apps\
2. Unzip and untar the file.
3. Go into the bit9-secapp directory and create a new directory named local.
4. Copy default\inputs.conf into the local directory.
5. Edit the first line of local\inputs.conf to point to the location of the Export Directory configured on the Cb Protection console System Configuration/External Analytics page, and save the file. For example, if the Export Directory on the Cb Protection Server is D:\Bit9\LogFiles, the first line of inputs.conf should be changed to the following:
   [monitor://D:\Bit9\LogFiles\*.bt9]
6. At a command prompt, restart the Splunk Universal Forwarder:

cd \Program Files\SplunkUniversalForwarder\bin

.\splunk restart

When you have completed all of these steps, the Cb Protection-Splunk integration should be complete and data from Cb Protection should begin flowing to Splunk. Please click on the Contact link if you have questions.