Set up Splunk Cloud Connect to use the agentic SOC

Set up Splunk Cloud Connect to use the agentic capabilities in Splunk Enterprise Security by connecting on-premises deployments of Splunk Enterprise Security with Cloud-native, Splunk managed, or Splunk Cloud Services (SCS) security extensions. For troubleshooting common UI issues, see Troubleshoot common issues using Splunk Cloud Connect.

Prerequisites to use the agentic SOC with Splunk Cloud Connect

Meet the following prerequisites to use the agentic SOC with Splunk Cloud Connect:

  • Install Splunk Platform version 10.4 or higher
  • Install Splunk Enterprise Security version 8.8 and higher.
  • Download the Splunk Cloud Connect app version 2.0 or higher from Splunkbase for Splunk Enterprise Security version 8.8 or higher.
  • Download the Splunk AI Assistant version 2.4 or higher from Splunkbase.
For more information:

Install Splunk Cloud Connect and Splunk AI Assistant (SAIA)

Note: AI Assistant in Splunk Enterprise Security is available if you are on Splunk Cloud Platform or use Splunk Cloud Connect to connect on-premise deployments of Splunk Enterprise Security with Cloud-native, Splunk managed, or Splunk Cloud Services (SCS). Splunk Cloud Connect is supported for both private cloud and on-premises deployments.

Follow these steps to upgrade Splunk Cloud Connect and install Splunk AI Assistant:

  1. Upgrade Splunk Cloud Connect by ensuring that you select the checkbox to upgrade the app.
  2. Install the Splunk AI Assistant app: Go to Apps and select Manage and then select Install App From File.
    Note: SAIA installation prompts you to set up the app. The instructions direct you to the Splunk Cloud Connect Status page to activate the SAIA product. You are now ready to use SAIA and any app that requires STC.

Set up Splunk Cloud Connect

Follow these steps to set up Splunk Cloud Connect for the agentic SOC:
  1. In Splunk Platform, go to Apps and select Splunk Cloud Connect.
  2. Select an appropriate Splunk Cloud Region for your connection. For example: US-East; US-West
  3. Enter a preferred tenant name or identifier. For example, mytenant, my-tenant, t-name-123​.
    Note: The preferred tenant identifier must begin with one or more lowercase alphanumeric characters​, which is optionally followed by hyphen-separated segments of length between 3 and 63 characters. Domain URLs and GUIDs are not supported. Additionally, the segments cannot start or end with a hyphen.
  4. Enter an email address associated with your Splunk purchase account or the Salesforce (SFDC) email associated with your Splunk license account.
  5. Select the checkbox and agree to the General Terms.
  6. Select Submit.
  7. Select Confirm and continue to confirm your Splunk Cloud Connect information.
  8. Get the one-time passcode from your email and enter the passcode.
  9. Select Submit.
  10. Wait for the onboarding process to complete.
    Note: You might receive some warnings indicating that STC is not set up. You can ignore those warnings as STC is set up in a future step.

Activate Splunk Enterprise Security services using Splunk Cloud Connect

Note: You can activate a service only after Splunk Cloud Connect is configured. It can take up to 30 minutes to complete setting up Splunk Cloud Connect. You can activate only one service at one time.

Follow these steps to activate Splunk Enterprise Security services on Splunk Cloud Connect:

  1. In the Cloud Connect Overview page, go to Available features.
  2. Select the Activate button for Splunk Enterprise Security Essentials or Premier.
    Note: Wait for the activation to complete. This can take a few minutes. Do not attempt to activate other products or refresh the page.
  3. Activate Splunk AI Toolkit and wait for it to complete.

Use Splunk Cloud Connect with Splunk tokens

To use Splunk Cloud Connect with Splunk tokens, you must add a certificate file to the [oauth2_settings] stanza in the $SPLUNK_HOME/etc/system/local/authentication.conf configuration file. The certificate file must be the same file across all search heads in a search head cluster. For more information, see authentication.conf file in the Splunk Enterprise Admin Manual. This ensures a secure link between your on-premises deployment and Splunk Cloud Services.

CODE 
[oauth2_settings] 
certFile = <absolute_path_to_cert_file>.pem 
sslPassword = <password>

Follow these steps to use Splunk Cloud Connect with Splunk tokens:

  1. Run the following curl command and replace the <stack-ip> with the IP address of your Splunk deployment.
    CODE 
    curl -sku 'admin:Chang3d!' -X POST -d 'name=oauth2_settings' -d 'certFile=/opt/splunk/etc/auth/oauth2_signing.pem' -d "sslPassword=2f62961f331cdf620003bda4e627f3daf1df9b33028004486e5db17318c798f9" 'https://<stack-ip>:8089/servicesNS/nobody/system/configs/conf-authentication?output_mode=json'
  2. Use the reload endpoint to ensure that the certificate is refreshed and replace the <stack-ip> with the IP address of your Splunk deployment.
    CODE 
    curl -sk -u 'admin:Chang3d!' -X POST 'https://<stack-ip>:8089/services/admin/tokens-keys/_reload?output_mode=json'

  3. Wait for a minute to pick up the certificate changes to set up using Splunk Splunk Cloud Connect automatically.