Skip to content
Open
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 9 additions & 7 deletions README.md
Original file line number Diff line number Diff line change
@@ -1,21 +1,23 @@
# InfocyteSplunkApp
Setup HUNT Server
- Install Infocyte HUNT
Install Infocyte HUNT App in Splunk
- Copy app the infocyte_hunt_app folder to *Splunk installation directory*\etc\app\

Install Infocyte HUNT App in Splunk
- Copy app the infocyte_hunt_app folder to *Splunk installation directory* \etc\apps\
- Restart Splunk
Pull up the HTTP Event Collector

Pull up the HTTP Event Collector
- Open the Settings dropdown menu in Splunk
- Click Data Inputs > HTTP Event Collector
- Note the Token Value for the collector called "infocyte" with the description "Infocyte HUNT HTTP Input"

Setup Splunk Integration in HUNT
- Sign in to HUNT as an administrator
- Click Admin > Integrations > Splunk
- Click Add Splunk Integration
- Enter the information for your Splunk server, and the Token Value from your Splunk HTTP Event Collector
- Enter the FQDN or IP address for the Splunk server in the "Server" textbox
- Enter the port number for the Splunk server in the "Port" textbox (Port 8088 is the default)
- Enter the "Infocyte HUNT HTTP Input" token value from the Splunk server, into the "HTTP Event Collector Token" textbox
- Make sure the "Enabled?" checkbox is filled, select which data you would like to have appear in Splunk, and click create

Run a scan! Happy Hunting!