All Apps and Add-ons

Will the Optiv Threat Intel app work in our (possibly unusual) Splunk deployment?

amcquay
Engager

We have a redundant pair of Splunk indexers/search heads that are digesting syslog data from our management network (read: no forwarders). I've installed the Optiv Threat Intel app but all panels simply display "no results found". The troubleshooting page displays "search did not return any events" as well.

I assume the app depends on the TA Threats app running on a separate forwarder in order to work properly?

kchamplin_splun
Splunk Employee
Splunk Employee

According to their documentation for the app - it looks like you need to install the optiv_TA_threat onto a heavy forwarder. So I think you're right.
https://splunkbase.splunk.com/app/2837/#/details

As of version 3.20, the app has split into two: optiv_threat_intel (this app) and optiv_TA_threat.
The optiv_threat_intel app continues to be installed on search heads. the optiv_TA_threat app
is to be installed on a single heavy forwarder in the environment only.

Install matrix:

Splunk role: App to install
Indexer: none*
Search head: optiv_threat_intel
Heavy forwarder: optiv_TA_threat

*create an "optiv" index on each indexer

derekarnold
Communicator

Agreed. It looked like from OP's post maybe a heavy forwarder isn't in the environment. If you just have indexers and search heads, I'd put optiv_TA_threat on a single search head. Also, don't forget to create an optiv index if you haven't already. Read the readme.pdf carefully for more details.

amcquay
Engager

Correct, there is no heavy forwarder in the environment. In fact the indexer and search head are on the same device (configured before I got involved, I'm working to change our Splunk architecture as we speak).

I created an optiv index and installed the TA_threat app on the server as well, and after ~36 hours the splash page is now populated. Thanks for the input.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...