Splunk SOARの評価版を使ってみた

$ lsblk
NAME             MAJ:MIN RM  SIZE RO TYPE MOUNTPOINTS
sda                8:0    0   30G  0 disk
tqsda1             8:1    0    1G  0 part /boot
mqsda2             8:2    0   29G  0 part
  tqol_vbox-root 252:0    0   26G  0 lvm  /
  mqol_vbox-swap 252:1    0    3G  0 lvm  [SWAP]
sdb                8:16   0  560G  0 disk
sr0               11:0    1 1024M  0 rom

# sudo mkfs.xfs /dev/sdb
meta-data=/dev/sdb               isize=512    agcount=4, agsize=36700160 blks
         =                       sectsz=512   attr=2, projid32bit=1
         =                       crc=1        finobt=1, sparse=1, rmapbt=0
         =                       reflink=1    bigtime=1 inobtcount=1 nrext64=0
data     =                       bsize=4096   blocks=146800640, imaxpct=25
         =                       sunit=0      swidth=0 blks
naming   =version 2              bsize=4096   ascii-ci=0, ftype=1
log      =internal log           bsize=4096   blocks=71680, version=2
         =                       sectsz=512   sunit=0 blks, lazy-count=1
realtime =none                   extsz=4096   blocks=0, rtextents=0

# sudo mkdir /mnt/splunk


# sudo mount -t xfs /dev/sdb /mnt/splunk

# df -h
ファイルシス             サイズ  使用  残り 使用% マウント位置
devtmpfs                   4.0M     0  4.0M    0% /dev
tmpfs                      3.7G     0  3.7G    0% /dev/shm
tmpfs                      1.5G  8.6M  1.5G    1% /run
/dev/mapper/ol_vbox-root    26G  2.2G   24G    9% /
/dev/sda1                  960M  324M  637M   34% /boot
tmpfs                      749M     0  749M    0% /run/user/0
/dev/sdb                   560G  4.0G  556G    1% /mnt/splunk

$ sudo dnf install -y wget tar

$ cd /mnt/splunk


$ wget -O splunk_soar-unpriv-7.1.0.225-dadc4693-el9-x86_64.tgz "https://download.splunk.com/products/splunk_soar-unpriv/releases/7.1.0/linux/splunk_soar-unpriv-7.1.0.225-dadc4693-el9-x86_64.tgz"

$ systemctl status firewalld
● firewalld.service - firewalld - dynamic firewall daemon
     Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; preset: enabled)
     Active: active (running) since Sat 2025-12-27 16:27:16 JST; 20h ago
       Docs: man:firewalld(1)
   Main PID: 765 (firewalld)
      Tasks: 2 (limit: 23100)
     Memory: 40.2M (peak: 60.8M)
        CPU: 938ms
     CGroup: /system.slice/firewalld.service
             mq765 /usr/bin/python3 -s /usr/sbin/firewalld --nofork --nopid

12月 27 16:27:15 localhost systemd[1]: Starting firewalld - dynamic firewall daemon...
12月 27 16:27:16 localhost systemd[1]: Started firewalld - dynamic firewall daemon.

firewalldデーモンをインストールする。
$ sudo yum install firewalld


firewalldサービスを起動する。
$ sudo systemctl start firewalld


firewalldサービスの自動起動を有効化する。
$ sudo systemctl enable firewalld

$ cat /proc/sys/crypto/fips_enabled
1

$ sudo yum clean all


$ sudo yum update -y

$ tar -xzvf ./splunk_soar-unpriv-7.1.0.225-dadc4693-el9-x86_64.tgz


$ cd splunk-soar

# ./soar-prepare-system --splunk-soar-home /mnt/splunk --https-port 8443
Do you wish to proceed? (y/N):
　　→「y」を入力して[Enter]
Download packages available in the default CentOS and RHEL repos (Y/n):
　　→「Y」を入力して[Enter]
GlusterFS is only needed if you are using an external file share. This is common if you're constructing a Splunk SOAR cluster.
Do you want to run this step? (Y/n):
　　→「n」を入力して[Enter]
Enable the sysstat service. Required if you want to forward Splunk Addon For Linux Logs.
Do you want to run this step? (Y/n):
　　→「Y」を入力して[Enter]
Ensure that the required ports are opened in firewalld. Do not run if not using firewalld.
Do you want to run this step? (Y/n):
　　→「Y」を入力して[Enter]
Make Splunk SOAR available on the default HTTPS port (443) in addition to the configured port. Do not run if not using firewalld or if creating a cluster.
Do you want to run this step? (Y/n):
　　→「Y」を入力して[Enter]
Create a non-privileged user for running Splunk SOAR (On-premises). (Y/n):
　　→「Y」を入力して[Enter]
Do you want to set a password for 'phantom' now? (Y/n):
　　→「Y」を入力して[Enter]
ユーザー phantom のパスワードを変更。
新しい パスワード:
　　→任意のパスワードを入力して[Enter]
新しい パスワードを再入力してください:
　　→任意のパスワードを入力して[Enter]
Set system resource limits for Splunk SOAR user, particularly file descriptor limits, which are low by default. (Y/n):
　　→「Y」を入力して[Enter]

# locale -a
ーーー（省略）ーーー
ja_JP.eucjp
ja_JP.utf8
ーーー（省略）ーーー


# sudo yum -y install glibc-locale-source


# sudo localedef -i en_US -c -f UTF-8 -A /usr/share/locale/locale.alias en_US.UTF-8

# su phantom

$ ./soar-install --splunk-soar-home /mnt/splunk --https-port 8443
You are about to install Splunk SOAR version 7.1.0.225.
  - Installation path: /mnt/splunk
  - HTTPS port: 8443

Do you wish to proceed? (y/N): 
　　→「y」を入力して[Enter]