Platform

Featured Integrations

Reduce risk and mitigate cyber attacks, no matter your IT & security stack, maturity journey, or industry

See our Threat Intelligence Solutions in Action

Outcomes

Threat Intelligence solves pervasive challenges

Reduce operational risk through timely, precise, and actionable intelligence.

See Recorded Future’s Intelligence in Action

Products

Services

Research

Minimize operational risks with our timely, precise, and actionable intelligence.

See Recorded Future in Action

Resource Center

Additional Resources

Additional Topics

Resources

Why Recorded Future

About Us

Partner With Us

Join Us

Company

brand-logo-long-black.svg

Rectangular Logo - Digital (RGB).svg

Blog

Careers at Recorded Future

Contact Us

Search Head Clustering

<article class="article clearfix">
  <div class="article__body markdown">
    <h1>Required configuration for Search Head clusters</h1>
    <h2>
      <a id="user-content-overview" class="anchor" href="https://splunkes-demo.recfut.com/en-US/app/TA-recorded_future/recorded_future_help_setup_shc#overview" aria-hidden="true"></a>Overview
    </h2>
    <p>
      The Recorded Future Add-on for Splunk Enterprise Security is designed
      to run on Search Heads within a Splunk system. In the case of a Search
      Head cluster (SHC) the installation proceedure is the standard one for
      SHCs, ie it should be installed on the deployer node and then deployed
      the SHC nodes.
    </p>
    <p>
      <strong>Before deploying the app the required configuration change below should have been made to ensure SHC configuration coherency.</strong>
    </p>
    <p>
      The app will detect that it is operated on a SHC. Only the captain node
      of the SHC will run the modular inputs for updating risklists and alerts.
    </p>
    <h2>
      <a id="user-content-required-configuration" class="anchor" href="https://splunkes-demo.recfut.com/en-US/app/TA-recorded_future/recorded_future_help_setup_shc#required-configuration" aria-hidden="true"></a>Required
      configuration
    </h2>
    <p>
      In order to maintain coherent configuration across the SHC it is necessary
      to modify the list of configuration file types that are synchronized
      across the SHC. Two additional configuration files are required:
    </p>
    <ul>
      <li>
        input.conf which contains the configured modular inputs used to update
        risklists and alers.
      </li>
      <li>
        ta_recorded_future_settings.conf which contains the configure API
        key (encrypted) and various app specific settings.
      </li>
    </ul>
    <p>
      Splunk does not allow apps to ship with the required configuration settings
      at this time so this configuration must be done by the client.
    </p>
    <p>
      The following stanza is needed in&nbsp;<code>$SPLUNK_HOME/etc/system/local/server.conf</code>:
    </p>
    <pre>[shclustering]
conf_replication_include.ta_recorded_future_settings = true
conf_replication_include.inputs = true
</pre>
    <p>
      Once this change had been made and the app has been deployed it's possible
      to connect to any of the SCH search head nodes and perform setup.
    </p>
  </div>
  <div class="article__attachments">&nbsp;</div>
</article>
<footer class="article-footer clearfix">
  <div class="article-vote">&nbsp;</div>
</footer>

Refine your search

We could not find any results for your search, so why not start with the articles listed below?

검색 헤드 클러스터링

검색 헤드 클러스터에 필요한 구성

개요

필수 구성