topic Re: Any guidance on CyberArk TA v1.2 Installation? in Splunk Search

Any guidance on CyberArk TA v1.2 Installation?

SplunkDash — Thu, 18 Aug 2022 20:28:26 GMT

Hello,

I need some guidance to install CyberArk TA in a single-server SPLUNK enterprise environment. How would I proceed with this installation process? Any help will be highly appreciated. Thank you so much.

Re: Any guidance on CyberArk TA v1.2 Installation?

richgalloway — Thu, 18 Aug 2022 20:36:21 GMT

Have you read the instructions? The docs at https://docs.splunk.com/Documentation/AddOns/released/CyberArk/Installation say there are no special considerations for installing the TA in a distributed environment. That means the same instructions apply to a single-instance Splunk environment. There's even a link to single-instance instructions at the bottom of the page.

Re: Any guidance on CyberArk TA v1.2 Installation?

SplunkDash — Fri, 19 Aug 2022 02:48:56 GMT

Hello,

Thank you so much for your reply. I went through before reaching out to SPLUNK community. Now went through in detail. My one question, in the instructions, they mentioned on web form and select Install app from file. Is there any ways I can install the CyberArk TA from the CLI interface. I already downloaded the TA. Any help will be highly appreciated. Thank you.

Re: Any guidance on CyberArk TA v1.2 Installation?

richgalloway — Fri, 19 Aug 2022 13:19:20 GMT

Yes, you can install the TA from the CLI. Just about any app can be installed that way.

In this case, just expand the downloaded file (it should be a compressed tarball) into the $SPLUNK_HOME/etc/apps directory. Then restart Splunk.

Re: Any guidance on CyberArk TA v1.2 Installation?

SplunkDash — Fri, 19 Aug 2022 14:14:49 GMT

Hello,

Yes, I installed and SPLUNK is getting events from that. Is there any documentations on CyberArk TA, I looked at the SPLUNK side, but couldn't find any. Your help will be highly appreciated, thank you!

Re: Any guidance on CyberArk TA v1.2 Installation?

richgalloway — Fri, 19 Aug 2022 15:22:21 GMT

The link in my first reply will take you to the complete documentation for the TA.

Re: Any guidance on CyberArk TA v1.2 Installation?

SplunkDash — Fri, 19 Aug 2022 15:26:45 GMT

Hello,

Thank you so much again. That takes me to the complete documentation for the TA in general. But do we have anything specific on CyberArk TA like any SOP (operational procedure) on it. Thank you!

Re: Any guidance on CyberArk TA v1.2 Installation?

richgalloway — Fri, 19 Aug 2022 15:31:43 GMT

The link (https://docs.splunk.com/Documentation/AddOns/released/CyberArk/Installation) is specific to the CyberArk TA. That is all the TA-specific documentation I am aware of.

What question are you trying to answer?

Re: Any guidance on CyberArk TA v1.2 Installation?

SplunkDash — Fri, 19 Aug 2022 15:47:16 GMT

Hello,

It says "

Install this add-on to all search heads where CyberArk knowledge management is required.

I installed it on a machine where UF installed on it. Do I still need to install it on SH, it says it is required. Thank you so much again.

Re: Any guidance on CyberArk TA v1.2 Installation?

richgalloway — Fri, 19 Aug 2022 16:00:28 GMT

It is required on the search head so please install it there. It is not used on UFs.