# Spectra Intelligence App for Splunk SOAR Installation Guide

> This article describes how to setup and configure the ReversingLabs Spectra Intelligence App for Splunk SOAR.

## Overview

This guide will describe the process of installing and configuring the ReversingLabs Spectra Intelligence app for Splunk SOAR.

## Prerequisites

Before you begin, ensure you have:

1. A Splunk SOAR on-prem or Splunk SOAR Cloud instance versions 6.3, 6.2, or 6.1
2. Administrator access to your Splunk environment
3. A valid splunk.com username and password
4. A valid ReversingLabs Spectra Intelligence username and password

## Installation Steps

1. Log in to your Splunk SOAR instance as an administrator
2. Navigate to "Apps"
3. Click "New Apps"
4. Enter "ReversingLabs" in the search box
5. Click "Install" next to "ReversingLabs TitaniumCloud v2"

![Splunk SOAR App installation screen with ReversingLabs TitaniumCloud v2](../images/rl-spectra-intel-install1.png)

## Configuration Steps

1. Navigate to the "Unconfigured Apps" section
2. Click "Configure New Asset"

![Splunk SOAR Unconfigured Apps section with Configure New Asset button](../images/rl-spectra-intel-install2.png)

3. Enter a custom name for the asset
4. Click "Asset Settings"
5. Enter the "https://data.reversinglabs.com" in the "TitaniumCloud URL" field
6. Enter a valid Spectra Intelligence username and password in the associated fields

![Splunk SOAR asset configuration form for TitaniumCloud connection](../images/rl-spectra-intel-install3.png)

7. Click the "Save" button"
8. Click the "Test Connectivity" button to validate the settings

![Splunk SOAR asset configuration Save and Test Connectivity buttons](../images/rl-spectra-intel-install4.png)

## Associated Playbooks

Two playbooks have been published to the Splunk SOAR community repository with this
app, which are designed to help provide examples of using the actions provided by
the ReversingLabs Spectra Intelligence app for Splunk SOAR.

![Splunk SOAR example playbooks for ReversingLabs Spectra Intelligence integration](../images/rl-spectra-intel-install5.png)

To use these playbooks, actions within the playbook need to point to the correct
asset created in the earlier sections of this document. Click the playbook to open
the editor, which will indicate a missing configuration. Click "View" to begin
updating the playbook:

![Splunk SOAR playbook editor showing missing asset configuration](../images/rl-spectra-intel-install6.png)

Select the asset created earlier from the dropdown menu, then click "save":

![Splunk SOAR playbook asset selection dropdown and save button](../images/rl-spectra-intel-install7.png)

Click the "Save" button again, then enter a comment to save the updated playbook
to the local repository:

![Splunk SOAR playbook save dialog with comment field](../images/rl-spectra-intel-install8.png)
