Skip to main content

Spectra Intelligence App for Splunk SOAR Installation Guide

Overview​

This guide will describe the process of installing and configuring the ReversingLabs Spectra Intelligence app for Splunk SOAR.

Prerequisites​

Before you begin, ensure you have:

  1. A Splunk SOAR on-prem or Splunk SOAR Cloud instance versions 6.3, 6.2, or 6.1
  2. Administrator access to your Splunk environment
  3. A valid splunk.com username and password
  4. A valid ReversingLabs Spectra Intelligence username and password

Installation Steps​

  1. Log in to your Splunk SOAR instance as an administrator
  2. Navigate to "Apps"
  3. Click "New Apps"
  4. Enter "ReversingLabs" in the search box
  5. Click "Install" next to "ReversingLabs TitaniumCloud v2"

alt text

Configuration Steps​

  1. Navigate to the "Unconfigured Apps" section
  2. Click "Configure New Asset"

alt text

  1. Enter a custom name for the asset
  2. Click "Asset Settings"
  3. Enter the "https://data.reversinglabs.com" in the "TitaniumCloud URL" field
  4. Enter a valid Spectra Intelligence username and password in the associated fields

alt text

  1. Click the "Save" button"
  2. Click the "Test Connectivity" button to validate the settings

alt text

Associated Playbooks​

Two playbooks have been published to the Splunk SOAR community repository with this app, which are designed to help provide examples of using the actions provided by the ReversingLabs Spectra Intelligence app for Splunk SOAR.

alt text

To use these playbooks, actions within the playbook need to point to the correct asset created in the earlier sections of this document. Click the playbook to open the editor, which will indicate a missing configuration. Click "View" to begin updating the playbook:

alt text

Select the asset created earlier from the dropdown menu, then click "save":

alt text

Click the "Save" button again, then enter a comment to save the updated playbook to the local repository:

alt text