Since this app does the scripted input/cron job to get data, you'll need to install it on a HF or a Search head for your data collection, plus any indexers you plan on using to index the data and the search heads you plan on searching the data from (including Splunk ES).
Once you've done that, you'll need to go to the node you've chosen as the data collector (either a SH or HF) and generate the inputs either using the web config for the TA or by hand editing the conf files provided in the TA (web gui is easier, but you'll want to change your app context to this TA before you go to settings and set everything up so the new conf files get stored within the app).
Once your Rapid7 detections are run and the input picks up the new data you'll then be able to search and so on. Not this app appears to not meet the specs for index cluster deployment as the bundles fail validation with this app (did not include a spec file for a custom .conf they have, also thinks one of the default values is invalid likely due to the lack of spec file).
