Setup & Installation

This guide walks you through installing Patronus SIEM v2.0.0 in your Splunk environment and completing the initial configuration.

Requirements

  • Splunk Enterprise 9.0 or later (on-premise or cloud)
  • Operating System: Linux, macOS, or Windows (wherever Splunk runs)
  • Splunk Role: admin or sc_admin role required for installation
  • Python: Python 3 must be enabled in Splunk (Settings → Server Settings → General → Python version)
  • License Key: A valid Patronus SIEM license key (contact support@corporatemutt.com for trial keys)

Architecture Overview

Patronus SIEM v2.0.0 uses a modern architecture:

  • Frontend: React 18 single-page application with TypeScript, Tailwind CSS v4, and Recharts for rich visualizations. Built with RSBuild and served from the app's static directory.
  • Backend: Python ASGI application (Starlette) exposing REST API endpoints for all data operations. Runs as a Splunk custom REST handler.
  • Data Layer: Splunk KVStore collections for persistent state (incidents, notes, configuration), Splunk saved searches for detections, and CIM data models for cross-source correlation.

Installation

Step 1 — Download the App Package

Download the latest .tgz package from the Patronus support portal or from the link provided in your purchase confirmation email.

Step 2 — Install via Splunk Web

  1. Log in to Splunk Web as an admin user.
  2. Navigate to Apps → Manage Apps.
  3. Click Install app from file.
  4. Browse to the downloaded .tgz file and click Upload.
  5. Restart Splunk when prompted.

Step 2 (Alternative) — Install via CLI

# Extract the app into the Splunk apps directory
tar xzf patronus-siem-*.tgz -C $SPLUNK_HOME/etc/apps/

# Restart Splunk
$SPLUNK_HOME/bin/splunk restart

Step 3 — Activate Your License

  1. Open Patronus SIEM from the Splunk app menu.
  2. You will be presented with the License Activation page on first launch.
  3. Paste your license key in the PTRON-XXXXX-XXXXX-... format.
  4. Click Activate License.
  5. The app will validate your key online and activate the instance.

Note: License activation requires outbound HTTPS access to patronus-license.fly.dev. If your Splunk server cannot reach the internet, contact support for offline activation instructions.

Verify Installation

After installation and license activation:

  1. Navigate to Configuration → Setup Check from the Patronus navigation menu.
  2. The Setup Check page runs pre-flight validations against your environment including:
    • KVStore collection availability
    • Required lookups and macros
    • Data model acceleration status
    • Python ASGI backend connectivity
    • License validation status
  3. Resolve any warnings or errors shown.
  4. Once all checks pass, the Executive Summary dashboard will be fully operational.

Required Data Sources

Patronus SIEM works with Splunk's Common Information Model (CIM). For full functionality, ensure these data models are populated:

Data Model Used For Example Sources
AuthenticationLogin/logoff tracking, identity research, failed login analysisActive Directory, LDAP, VPN, SSO
Network_TrafficNetwork flow analysis, lateral movement, relationship mappingFirewall, NetFlow, Zeek, Palo Alto
WebWeb activity, threat intel correlation, proxy analysisProxy, WAF, HTTP logs
EndpointProcess and file activity, endpoint detectionSysmon, CrowdStrike, Carbon Black, Microsoft Defender
Intrusion_DetectionIDS/IPS alerts, signature-based detectionSnort, Suricata, Palo Alto, Cisco
VulnerabilitiesVulnerability tracking and managementNessus, Qualys, Rapid7, Tenable
ChangeConfiguration changes, system modificationsActive Directory, OS audit logs
MalwareMalware detection and analysisAntivirus, EDR, sandbox solutions

Tip: Enable data model acceleration for each CIM model. This dramatically improves dashboard performance, especially for the Asset Deep Dive, Identity Deep Dive, and Network views. Navigate to Settings → Data Models and enable acceleration with a summary range of at least 7 days.

Initial Configuration

After installation, complete these essential configuration steps:

  1. Define Corporate Subnets — Go to Configuration → Corp Subnets and add your internal network ranges in CIDR notation. This enables proper internal vs. external traffic classification in the Network view.
  2. Import Assets — Go to Configuration → Assets and import your asset inventory (hostname, IP, MAC, category, priority, owner). This enriches the Asset Deep Dive and Scoreboard views.
  3. Import Identities — Go to Configuration → Identities and import your user directory (username, name, email, department, manager, priority). This enriches the Identity Deep Dive and incident views.
  4. Configure Threat Feeds — Go to Configuration → Threat Feeds and add your threat intelligence sources (IP feeds, domain feeds, file hash feeds). Feeds are refreshed on a configurable schedule.
  5. Set SLA Targets — Go to Configuration → SLA Targets and configure your MTTA (Mean Time to Acknowledge) and MTTR (Mean Time to Resolve) targets for SLA compliance tracking.
  6. Add SOC Analysts — Assign the patronus_user Splunk role to your SOC team members so they appear in the analyst assignment dropdowns.

Upgrading from v1.x

If upgrading from Patronus SIEM v1.x:

  1. Back up your existing $SPLUNK_HOME/etc/apps/patronus/ directory.
  2. Install the v2.0.0 package using either the Splunk Web or CLI method above.
  3. Restart Splunk.
  4. Existing KVStore data (incidents, assets, identities, configuration) is preserved automatically.
  5. Run the Setup Check to verify all new components are operational.

Note: v2.0.0 replaces all SimpleXML dashboards with a React single-page application. Your Splunk saved searches, lookups, and KVStore data are fully preserved. No data migration is required.

Next Steps

Once installed and verified, proceed to the Configuration Guide to set up risk thresholds, detection rules, and team management.

Configuration