Splunk SOAR (On-premises) release 6.1.1 added support for external PostgreSQL 15.X databases. Splunk SOAR (On-premises) release 6.2.0 upgrades the internal PostgreSQL database to 15.3 for all deployments.

To configure an external PostgreSQL 15.X database, follow the directions in this topic.

For information on upgrading PostgreSQL see Upgrading a PostgreSQL Cluster on postgresql.org.

1. Install one of the operating systems supported by PostgreSQL 15. PostgreSQL 15.3 or higher is recommended, but you may use any release of PostgreSQL 15.x. Configure the operating system according to your organization's requirements. See Supported Platforms on PostgreSQL.org.
2. Update the kernel semaphore parameters and refresh the system configuration.

   echo "kernel.sem=250 32000 32 5000" >> /etc/sysctl.conf 
   sysctl --system
   

3. Configure your firewall to allow access. For a complete list of ports, see Splunk SOAR (On-premises) required ports.
4. Add any additional yum repositories that you need. Use the tool on the Linux downloads (Red Hat family) page to identify the correct repository for your architecture and operating system combination.

   yum install <URL>

5. Install the PostgreSQL server.

   yum install postgresql15-server-15.3

6. Initialize the PostgreSQL database.

   /usr/pgsql-15/bin/postgresql-15-setup initdb

7. Set PostgreSQL to start when the system starts.

   systemctl enable postgresql-15

8. Start the PostgreSQL database.

   systemctl start postgresql-15

9. Change to the postgres user.

   su - postgres

10. Change to the PostgreSQL data directory.

    cd /var/lib/pgsql/15

11. Generate the SSL certificate PostgreSQL uses.

    openssl req -new -x509 -days 3650 -nodes -text -out server.crt -keyout server.key -subj "/CN=postgres.cluster1"

    Note: You can use an SSL certificate purchased from a Certificate Authority instead of generating a self-signed certificate.
12. Set the permissions on the server.key file.

    chmod og-rwx server.key

13. Run a PostgreSQL shell as the postgres user.
    Note: You should already be the postgres user.

    psql

14. Set the postgres user password, if it has not already been set.

    ALTER USER postgres PASSWORD '<postgrespassword>';

15. Create the pgbouncer user.

    CREATE USER pgbouncer PASSWORD '<pgbouncerpassword>';

16. Set PostgreSQL to use SSL. Provide the keys and cipher level.

    ALTER SYSTEM SET ssl = on; 
    ALTER SYSTEM SET ssl_cert_file = '/var/lib/pgsql/15/server.crt'; 
    ALTER SYSTEM SET ssl_key_file = '/var/lib/pgsql/15/server.key'; 
    ALTER SYSTEM SET ssl_ciphers = 'HIGH:+3DES:!aNULL';
    

17. Exit the PostgreSQL shell by typing CTRL+D.
18. Change back to the root user.

    exit

19. Edit the pg_hba.conf file to enable access to the database. Splunk SOAR (On-premises) must be able to connect as both the postgres and pgbouncer users. In each entry, supply the IP range that will be used by your Splunk SOAR (On-premises) install or cluster.

    # TYPE  DATABASE    USER        ADDRESS         METHOD
    local   all	    all         peer		
    hostssl all         postgres    <IP Range>/<XX> md5
    hostssl phantom     pgbouncer   <IP Range>/<XX> md5
    

20. Edit postgresql.conf. Set values for max_connections, work_mem, shared_buffers, and listen_address.

    max_connections=2500
    work_mem=2796kB
    shared_buffers=2GB
    listen_addresses = '*' # what IP address(es) to listen on;

    Note: Several factors can influence the amount of memory dedicated to the work_mem setting. Larger, high event volume deployments will want significantly more, while smaller, lower volume deployments may use slightly less. The setting above assumes a medium sized deployment with a moderate event volume.

    For listen_address set a value that matches your security requirements. Valid settings are:

    • * for all addresses, 0.0.0. for all IPv4 addresses
    • :: for all IPv6 addresses
    • specific addresses you supply.
21. Restart the PostgreSQL service.

    systemctl restart postgresql-15

To backup a Splunk SOAR (On-premises) database and restore it on an external database, use the ibackup.pyc tool. See Splunk SOAR (On-premises) backup and restore overview in Administer Splunk SOAR (On-premises).

Some Splunk SOAR (On-premises) deployments, especially those in Amazon Web Services, may want to put the PostgreSQL database on its own host using AWS's Relational Database Service (RDS). These steps can also be used to migrate a standalone Splunk SOAR (On-premises) instance to an instance using a PostgreSQL database hosted in AWS' RDS.

For more information on building a PostgreSQL database host in RDS, see the Amazon Relational Database Service documentation.

For information on upgrading a PostgreSQL database in RDS see Upgrading the PostgreSQL DB engine for Amazon RDS in the AWS documentation.

You may need to change the IP address of your PostgreSQL database. If so, follow these steps.

1. Edit the <PHANTOM_HOME>/etc/pgbouncer/pgbouncer.database.ini file as shown in the following code. host is the IP address or DNS name of the database server.

   [databases]
   phantom = user=pgbouncer password=<pgbouncerpassword> host=<pg server>
   postgres = user=postgres password=<postgrespassword> host=<pg server>
   [pgbouncer]
   server_tls_sslmode = require
   

   Note: Amazon Web Services RDS PostgreSQL databases do not need the server_tls_sslmode = require entry.
2. Stop all Splunk SOAR (On-premises) services.

   <PHANTOM_HOME>/bin/stop_phantom.sh
   

3. Reload pgbouncer. For all deployments, use the following command:

   <PHANTOM_HOME>/bin/phsvc restart pgbouncer
   

4. Test the connection to the database server.

   <PHANTOM_HOME>/bin/phenv psql  -h /tmp -p 6432 -d postgres
   

   If connectivity is successful, you will see the following message:

   psql (15.3)
   Type "help" for help.
   postgres=#
   

   To exit from psql, use \q.
5. Start all Splunk SOAR (On-premises) services.

   <PHANTOM_HOME>/bin/start_phantom.sh