Edgescan Integration Add-on

1 – On Splunk homebase search Edgescan or click here

2 – Click Download

3 – From Splunk Web click on the gear beside ‘Apps’

4 – Select ‘Install app from file

5 – Locate the downloaded file and click Upload

6 – If Splunk Enterprise prompts you to restart, do so.

7 – Verify the add-on appears in the list of apps and add-ons. You can also find it on the server at $SPLUNK_HOME/etc/apps /<Name_of_add-on>.

Importing data into the Edgescan Integration

1 – Edgescan should be available in the lists of apps on the left hand side of your splunk enterprise homepage. Click on Edgescan.

2 – Under the inputs tab select Create New Input

3 – Select one of the options in the dropdown

4- Enter a name, interval, Index, Offset, Limit and X-Api-Token and click Add

a. Name – A name associated to the data, e.g Edgescan_vulnerabilities
b. Interval – time interval of input in seconds, e.g 900
c. Index – default
d. Offset – where server starts returning the rows. Default is 0.
e. Limit – how many results returned from the server. Default is 250.
f. X-Api-Token – API Key obtained from https://live.edgescan.com

5 – Under the ‘Search’ tab in the search bar there is the ability to search and filter through the results