parsedmarc/dashboards/splunk

===================
Splunk Installation
===================

Install Splunk for use with Docker
----------------------------------

Download latest Splunk image::

  docker pull splunk/splunk:latest

Run Splunk with Docker
----------------------

Listen on all network interfaces::

  docker run -d -p 8000:8000 -p 8088:8088 -e "SPLUNK_START_ARGS=--accept-license" -e "SPLUNK_PASSWORD=password1234" -e "SPLUNK_HEC_TOKEN=hec-token-1234" --name splunk splunk/splunk:latest

Listen on localhost for use with reverse proxy with base URL ``/splunk``::

  docker run -d -p 127.0.0.1:8000:8000 -p 127.0.0.1:8088:8088 -e "SPLUNK_START_ARGS=--accept-license" -e "SPLUNK_PASSWORD=password1234" -e "SPLUNK_HEC_TOKEN=hec-token-1234" -e "SPLUNK_ROOT_ENDPOINT=/splunk" --name splunk splunk/splunk:latest

Set up reverse proxy, e.g. Apache2::

  ProxyPass /splunk http://127.0.0.1:8000/splunk
  ProxyPassReverse /splunk http://127.0.0.1:8000/splunk

Splunk Configuration
--------------------

Access web UI at http://127.0.0.1:8000 and log in with ``admin:password1234``.

Create App and Index
~~~~~~~~~~~~~~~~~~~~

- Settings > Data > Indexes: New Index

  - Index name: "email"

- HEC token ``hec-token-1234`` should be already set up. 

  - Check under Settings > Data > Data inputs: HTTP Event Collector

- Apps > Manage Apps: Create app

  - Name: "parsedmarc"
  - Folder name: "parsedmarc"

Create Dashboards
~~~~~~~~~~~~~~~~~

1. Navigate to the app you want to add the dashboards to, or create a new app called DMARC
2. Click Dashboards
3. Click Create New Dashboard
4. Use a descriptive title, such as "Aggregate DMARC Data"
5. Click Create Dashboard
6. Click on the Source button
7. Paste the content of ''dmarc_aggregate_dashboard.xml`` into the source editor
8. If the index storing the DMARC data is not named email, replace index="email" accordingly
9. Click Save
10. Click Dashboards
11. Click Create New Dashboard
12. Use a descriptive title, such as "Forensic DMARC Data"
13. Click Create Dashboard
14. Click on the Source button
15. Paste the content of ''dmarc_forensic_dashboard.xml`` into the source editor
16. If the index storing the DMARC data is not named email, replace index="email" accordingly
17. Click Save

==============
Example Config 
==============

parsedmarc.ini::

  [splunk_hec]
  url = https://127.0.0.1:8088/
  token = hec-token-1234
  index = email
  skip_certificate_verification = True

Note that ``skip_certificate_verification = True`` disables security checks.

Run parsedmarc::

  python3 -m parsedmarc.cli -c parsedmarc.ini