You can either install Perseus directly by clicking the "Browse for apps" button on the Manage Apps page, searching for Perseus, and clicking the "Install" button. Or you can download Perseus from the Splunkbase and install it by clicking the "Install app from file" button on the Manage Apps page.
To install the Perseus app to a Search Head Cluster, you must use the Deployer. You have three options for how to install Perseus:
1.) Follow the instructions here for deploying a Splunk App with the Deployer: https://docs.splunk.com/Documentation/Splunk/latest/DistSearch/PropagateSHCconfigurationchanges
2.) You can download the production version of Perseus (see "How to Use Perseus" for more info) which comes with a deployment wizard that automates installation of Perseus into your environment. Please Note: This will install the production version of Perseus that does not come pre-loaded with the case study data.
3.) You may find it easiest to setup a stand-alone Splunk server and follow the "Single Splunk Search Head" instructions above. A stand-alone Splunk server can be installed in minutes. You can download a free trial here: https://www.splunk.com/en_us/download/splunk-enterprise.html
There are two versions of Perseus. The production version of Perseus allows you to process data from your environment to help you save time investigating incidents. It offers an automated deployment wizard that can install and configure Perseus in under 10 minutes. It comes with a 30 day trial license (60 days if you register) which allows you to process data from an unlimited number of hosts. After that, you can either purchase a license or continue using it for free. if you do not purchase a license, Perseus will be limited to processing data from 50 hosts per day. You can download the production version of Perseus at: https://PerseusSec.com/download-wizard/.
This version of the Perseus is the Perseus Demo. It contains real data from a case study so you can familiarize yourself with Perseus before you collect data from your own environment. While you're welcome to explore it on your own, it's recommended you step through the Perseus Demo Walkthrough to quickly learn about the capabilities of Perseus: https://PerseusSec.com/documentation/perseus-demo-walkthrough/. When you're ready to start using Perseus to help investigate incidents in your environment, download the production version of Perseus at: https://PerseusSec.com/download-wizard/
New In 1.6.5:
New In 1.6.X:
Explore Your Own Data Using Perseus: The Perseus Demo now allows you to gather and upload data from one of your Windows hosts so you can explore your own data inside Perseus. Open the "Start Investigating" Dashboard to begin.
UI Enhancements to Recollection Dashboard for Timeline-based Investigations
New In 1.6.4:
New In 1.6.X:
Explore Your Own Data Using Perseus: The Perseus Demo now allows you to gather and upload data from one of your Windows hosts so you can explore your own data inside Perseus. Open the "Start Investigating" Dashboard to begin.
UI Enhancements to Recollection Dashboard for Timeline-based Investigations
New In 1.6.3:
New In 1.6.X:
Explore Your Own Data Using Perseus: The Perseus Demo now allows you to gather and upload data from one of your Windows hosts so you can explore your own data inside Perseus. Open the "Start Investigating" Dashboard to begin.
UI Enhancements to Recollection Dashboard for Timeline-based Investigations
New In 1.6.2:
New In 1.6.X:
Explore Your Own Data Using Perseus: The Perseus Demo now allows you to gather and upload data from one of your Windows hosts so you can explore your own data inside Perseus. Open the "Start Investigating" Dashboard to begin.
UI Enhancements to Recollection Dashboard for Timeline-based Investigations
New In 1.6.1:
New In 1.6.X:
Explore Your Own Data Using Perseus: The Perseus Demo now allows you to gather and upload data from one of your Windows hosts so you can explore your own data inside Perseus. Open the "Start Investigating" Dashboard to begin.
UI Enhancements to Recollection Dashboard for Timeline-based Investigations
New In 1.6.0:
Explore Your Own Data Using Perseus: The Perseus Demo now allows you to gather and upload data from one of your Windows hosts so you can explore your own data inside Perseus. Open the "Start Investigating" Dashboard to begin.
UI Enhancements to Recollection Dashboard for Timeline-based Investigations
New In 1.5.X:
- New Recollection Dashboard for Timeline-based Investigations
- Splunk 8.0 Support
- Python 3.7 Support
- Performance Enhancements
New in 1.5.8:
- Added Recollection Event Changes Tracking: As you drag the Timeline Slider, the Treeview will highlight registry, file system, and forensic locations that were modified since your last selected time interval so you can better track what's changed.
New In 1.5.X:
- New Recollection Dashboard for Timeline-based Investigations
- Splunk 8.0 Support
- Python 3.7 Support
- Performance Enhancements
New in 1.5.7:
- Minor Updates to Recollection Event Caching
New In 1.5.X:
- New Recollection Dashboard for Timeline-based Investigations
- Splunk 8.0 Support
- Python 3.7 Support
- Performance Enhancements
New in 1.5.6:
- Recollection Event Caching: Perseus now supports caching of events on the Recollection Dashboard to improve performance when modifying the selected time interval or changing the selected overlay
New In 1.5.X:
- New Recollection Dashboard for Timeline-based Investigations
- Splunk 8.0 Support
- Python 3.7 Support
- Performance Enhancements
New in 1.5.5:
- Recollection Timeline Overlay: Make a selection from the Overlay dropdown to see where events of the selected type appear in the timeline to more quickly determine where to focus your investigation
New In 1.5.X:
- New Recollection Dashboard for Timeline-based Investigations
- Splunk 8.0 Support
- Python 3.7 Support
- Performance Enhancements
New in 1.5.4:
- Recollection Forensic Location Hiding: Click the icon of any of the "[Forensic Locations]" in the Recollection Treeview to hide its events in the table
New In 1.5.X:
- New Recollection Dashboard for Timeline-based Investigations
- Splunk 8.0 Support
- Python 3.7 Support
- Performance Enhancements
New in 1.5.3:
- Added Explicit Python Version Support to commands.conf for compatibility with new AppInspect
As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.