topic Re: Universal Forwarder in Security

Universal Forwarder

steve32507 — Thu, 04 Jan 2024 12:54:47 GMT

How do I remediate this vulnerability?

Tenable 164078

Upgrade Splunk Enterprise or Universal Forwarder to version 9.0 or later.

Re: Universal Forwarder

gcusello — Thu, 04 Jan 2024 13:05:59 GMT

Hi @steve32507,

could you better describe your question? it isn't readable.

Ciao.

Giuseppe

Re: Universal Forwarder

steve32507 — Thu, 04 Jan 2024 13:13:56 GMT

How do I upgrade Splunk Enterprise & Universal Forwarder to 9.0 or higher?

Re: Universal Forwarder

gcusello — Thu, 04 Jan 2024 13:51:36 GMT

Hi @steve32507,

what's your version?
anyway, here youcan find the upgrade procedure for Splunk Enterprise.

and here you can find the Universal Forwarders upgrade https://docs.splunk.com/Documentation/Splunk/9.1.2/Installation/HowtoupgradeSplunk procedure https://docs.splunk.com/Documentation/Forwarder/9.1.2/Forwarder/Upgradetheuniversalforwarder

The steps depend on the starting version.

Ciao.

Giuseppe

Re: Universal Forwarder

steve32507 — Thu, 04 Jan 2024 14:06:36 GMT

Thank you, have a good day!

Re: Universal Forwarder

gcusello — Thu, 04 Jan 2024 14:20:58 GMT

Hi @steve32507,

good for you, see next time!

let me know if I can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

Re: Universal Forwarder

isoutamo — Fri, 05 Jan 2024 09:02:49 GMT

you should remember that to getting supported state on your environment your Splunk server (and if you have heavy forwarders between UFs and Splunk servers) must be at least the same level than your UFs will be. In practically this means that you must 1st update your Splunk Server version to the same level where you are planning to upgrade your UFs.

r. Ismo

Re: Universal Forwarder

PickleRick — Fri, 05 Jan 2024 09:59:13 GMT

Luckily, the requirements are not that strict.

https://docs.splunk.com/Documentation/VersionCompatibility/current/Matrix/Compatibilitybetweenforwardersandindexers

I ran successfully 9.0 forwarders with 8.2 indexers for some time since the client's policy was to install the latest available UF.

But while the s2s protocol is not that often upgraded (and even so, the components can negotiate a lower version if one of the connection sides doesn't support the most recent version), there are some issues which can happen if you're using UF with a newer version than your indexers - in case of 9.0 forwarders it was that the forwarders generated events for the _configtracker index which did not exist on the indexers. But it was a minor annoyance, not a real problem.

Re: Universal Forwarder

steve32507 — Fri, 05 Jan 2024 12:45:19 GMT

Thank you, I will have to check the versions of each

Re: Universal Forwarder

steve32507 — Fri, 05 Jan 2024 12:46:20 GMT

Good news, thanks for sharing