Log in to the Splunk SOAR (On-premises) web interface

Perform the following tasks to log in to the Splunk SOAR (On-premises) web interface after installation is complete.

  1. Using a web browser, go to the IP address you assigned to Splunk SOAR (On-premises).
    • If you installed Splunk SOAR (On-premises) as an unprivileged user, log in to Splunk SOAR (On-premises)'s web interface at the custom HTTPS port. 
      https://<ip address or hostname>:<your https port>
  2. Log in using the default credentials. Use soar_local_admin as the username and password as the password.
  3. Change the soar_local_admin user's password:
    1. Click the user name soar_local_admin, then select Account Settings.
    2. Click the Change Password tab.
    3. Type the current password.
    4. Type a new password.
    5. Type a new password a second time to confirm.
    6. Click Change Password.

Log in to Splunk SOAR (On-premises) using SSH

To SSH into the Splunk SOAR (On-premises) instance perform the following steps:

  1. Open a terminal window.
  2. SSH to your Splunk SOAR (On-premises) instance's operating system ssh phantom@<hostname or IP address of Splunk SOAR (On-premises)>.

Remote SSH is turned off for the root user. The accounts user and phantom have sudo permissions. You can use the account user to administer the operating system.