The Endgame App for Splunk allows customers to prevent, detect and take action on endpoint activity directly from Splunk through the Endgame product. This makes real-time threat monitoring and analysis easy. The app provides details for alerts generated by Endgame and enables security analysts and administrators to connect alert data across all security infrastructures.
The Endgame App for Splunk gives security professionals and IT administrators the ability to:
Pre-requisit: https://splunkbase.splunk.com/app/4267/
The Endgame App for Splunk must be installed on the Search Head.
Install from the Splunk Store:
1. Login to Splunk, click on "Find More Apps", and search for "endgame":
2. Click on install for "Endgame App for Splunk":
3. After the installation, you’ll be asked to restart Splunk. Click on Restart Now:
4. After the restart, click on Endgame App for Splunk:
5. You will be asked to configure the app. Click on "Continue to app setup page":
-- Note: Alternatively, if you are not prompted to set up the app after installation, you can set it up by going to Manage Apps and clicking on Set up.
6. Enter the details of your Endgame server.
-- Endgame API Base URL: enter the URL for the Endgame server
-- Endgame Base URL: enter the URL for the Endgame server
-- Enter your Endgame credentials: enter the credentials of the "splunk" user created in Endgame
-- Enter the realm where the storage password can be found. By default this is "Endgame". You can customize this field by entering a different realm
7. The Endgame app is configured and ready to be used
Install from File:
1. Download the App package
2. In the UI navigate to: “Manage Apps’
3. In the top right corner select ‘Install app from file’
4. Select ‘Choose File’ and select the App package
5. Select ‘Upload’ and follow the prompts.
Note: By default the app is configured to only accept HTTPS API URL and forces SSL validation during API calls. To change this behaviour please checkout ADVANCED CONFIGURATION section of the README.
Visit - https://support.endgame.com/hc/en-us/articles/360018852991-Endgame-App-for-Splunk for detailed configuration instrunctions.
Note: By default the app is configured to only accept HTTPS API URL and forces SSL validation during API calls. To change this behaviour please checkout ADVANCED CONFIGURATION section of the README.
$SPLUNK_HOME$/etc/apps/Endgame/local
).disable_ssl_validation = True
flag in the conf file.Conf file may look like as follows after the change:
[app_config]
base_url = http://<your_url>
native_base_url = http://<your_url>
disable_ssl_validation = True
$SPLUNK_HOME$/etc/apps/Endgame/local
).disable_ssl_validation
flag is there (if not then add it under app_config stanza) then providing value from true
or 1
or yes
(note: this values are checked case insensitively) will disable SSL validation during API calls.Conf file may look like as follows after the change:
[app_config]
base_url = https://<your_url>
native_base_url = https://<your_url>
disable_ssl_validation = True
$SPLUNK_HOME$/etc/apps/Endgame/bin/certifi
).The user running and using the app must have "admin_all_objects" capability assigned to it.
Support Offered: No
Endgame App for Splunk
Author - Endgame, Inc
Version - 1.1.0
Build - 25
Creates Index - False
Splunk Enterprise version: 7.0.x, 7.1.x, 7.2.x , 7.3.x
OS: Platform independent
Prerequisites: (Not mandatory but Endgame API Add-on for Splunk is recommended)
As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.