/soar_installer_ansible

Ansible installation script for SOAR instances on CentOS7 hosts

soar_installer_ansible

Ansible installation script for SOAR instances on CentOS7 hosts

Introduction

This ansible playbook installs Splunk SOAR on remote machines running Centos7.

Requirements:

  • OS: CentOS 7

  • Internet access on the remote machine (to download the SOAR image)

  • Set the required parameters/variables in:

    hosts.yaml:

      remote host username (can also be passed via the CLI)

    vars.yaml:

      - SOAR image URL (get the "authenticated" download link from: https://my.phantom.us/downloads/)
  - desired password for `soaruser`: default is `soaruser`

Instructions:

  • Clone repository to your directory

     cd projects_directory
 git clone link name_of_folder
 cd name_of_folder

  • Create a new instance with i.e Nova EC2 with such parameters:

    • Instance Type m5.large for faster installing
    • Storage 100 GiB
    • OS centos 7

  • Copy your local ssh public key to the destination host(s):

    ssh-copy-id -i ~/.ssh/id_rsa.pub $USERNAME@$HOSTADDR

  • Set hosts file Add the address of the host(s) and ansible user (i.e soaruser) to the included hosts.yaml file.

  • Set vars file

    • Go to phantom-downloader and copy link to SOAR version which you need
      • Hint! - remember that token for link expired after ~10min
    • Paste this link to soar_download_url
    • Enter password

  • Run the playbook

    • Hint! - be aware what version of SOAR are you installing, if this is under 5.3v Run installer task should look like that:
      - name: Run installer
 	become: yes
 	become_user: soaruser
 	shell: "/tmp/phantom_tar_install.sh install"

    ansible-playbook -i hosts.yaml fdse_soar_installer.yaml

  • Wait for it :)

    By default, SOAR will run on port 8443 over HTTPS. The default login credentials are admin/password, for version 6.0.0 and higher soar_local_admin/password