splunk
TruSTAR Unified
Splunk Cloud
Splunk Built
Overview
TruSTAR integration for TruSTAR + Enterprise Security Customers.
Note: The TruSTAR product is no longer sold by Splunk. Support for the TruSTAR product and this app is per policy stated here: https://www.splunk.com/en_us/legal/splunk-software-support-policy.html [see section titled, "Splunk Intelligence Management (TruSTAR Legacy System)"]
Installation Docs:
https://docs.splunk.com/Documentation/SIM/current/Apps/Splunk#Integrate_Splunk_Intelligence_Management_with_Splunk_Enterprise_Security_deployments_to_improve_detection_and_triage
(video) Using this app to improve detection & triage: https://lantern.splunk.com/Splunk_Product_Learning_Guides/Splunk_Int_Mgmt/UnifiedApp_UseCase?mt-learningpath=intelmgmtunifiedappconfig#
** Notes to SplunkCloud SRE:
- This app must be installed on Enterprise Security searchheads (NOT IDM), and includes a modinput, which must be allowed to run on the searchhead. This app will not work on an IDM, indexer, or a search head which does not have Enterprise Security.
- This app's modinput contains checks to ensure that it will only run on the cluster Captain when installed on an ES SHC.
- The modinput fetches cyber threat observables from TruSTAR's REST API and posts them to the searchheads' kvstores using the kvstore "batch_save" endpoint, not an index as most modinputs do. This is why it must run on the searchheads, not an IDM. There is no config option that would allow the user to tell the modinput to post the observables to that endpoint on a different host, it's hard-coded to post to "localhost".
- This app is compatible with ES SHC, but its ES SHC compatibility is implemented in a way which requires replicating "inputs.conf" from all Splunk apps on the stack to all nodes in the SHC by setting "conf_replication_include.inputs = true" in "server.conf". This is standard for all Splunk apps created using Splunk's Addon Builder. If this behavior is problematic for other Splunk apps on the user's SHC, user will need to decide which app they prefer to use: TruSTAR Unified or the app with which that conflicts. See SINT-3685 for more details / information.
- The app contains modactions that need to be available on all ES SHC nodes, so the app needs to be installed on all SHC nodes.
References for exceptions to "no modinputs on SHs policy":
- Case #1685202 "Vet and Install TruSTAR App for Splunk ES." (Circa April 7, 2020) (TruSTAR App for Splunk ES was this app's predecessor)
- Case # 2646540
Note: The TruSTAR product is no longer sold by Splunk. Support for the TruSTAR product and this app is per policy stated here: https://www.splunk.com/en_us/legal/splunk-software-support-policy.html [see section titled, "Splunk Intelligence Management (TruSTAR Legacy System)"]
Installation Docs:
https://docs.splunk.com/Documentation/SIM/current/Apps/Splunk#Integrate_Splunk_Intelligence_Management_with_Splunk_Enterprise_Security_deployments_to_improve_detection_and_triage
(video) Using this app to improve detection & triage: https://lantern.splunk.com/Splunk_Product_Learning_Guides/Splunk_Int_Mgmt/UnifiedApp_UseCase?mt-learningpath=intelmgmtunifiedappconfig#
** Notes to SplunkCloud SRE:
- This app must be installed on Enterprise Security searchheads (NOT IDM), and includes a modinput, which must be allowed to run on the searchhead. This app will not work on an IDM, indexer, or a search head which does not have Enterprise Security.
- This app's modinput contains checks to ensure that it will only run on the cluster Captain when installed on an ES SHC.
- The modinput fetches cyber threat observables from TruSTAR's REST API and posts them to the searchheads' kvstores using the kvstore "batch_save" endpoint, not an index as most modinputs do. This is why it must run on the searchheads, not an IDM. There is no config option that would allow the user to tell the modinput to post the observables to that endpoint on a different host, it's hard-coded to post to "localhost".
- This app is compatible with ES SHC, but its ES SHC compatibility is implemented in a way which requires replicating "inputs.conf" from all Splunk apps on the stack to all nodes in the SHC by setting "conf_replication_include.inputs = true" in "server.conf". This is standard for all Splunk apps created using Splunk's Addon Builder. If this behavior is problematic for other Splunk apps on the user's SHC, user will need to decide which app they prefer to use: TruSTAR Unified or the app with which that conflicts. See SINT-3685 for more details / information.
- The app contains modactions that need to be available on all ES SHC nodes, so the app needs to be installed on all SHC nodes.
References for exceptions to "no modinputs on SHs policy":
- Case #1685202 "Vet and Install TruSTAR App for Splunk ES." (Circa April 7, 2020) (TruSTAR App for Splunk ES was this app's predecessor)
- Case # 2646540
Release Notes
Version 2.0.7
May 6, 2024
Update for Add-on-builder 4.1.4