topic Required Internet Endpoints for Splunk SIEM Functionality in Security

Required Internet Endpoints for Splunk SIEM Functionality

Nikolozts — Sat, 22 Mar 2025 06:55:45 GMT

hello,

Please write or send me document link which internet endpoints (URL, port) Splunk SIEM needs access to in order to function properly, download updates, apps, and anything else required for its normal operation.

Re: Required Internet Endpoints for Splunk SIEM Functionality

PickleRick — Sat, 22 Mar 2025 07:03:40 GMT

On-prem Splunk does not _need_ anything from the internet to work correctly.

Some functionalities can be useful (like aforementioned updates for apps) but they are not obligatory and are often done different way around (manually downloading app/software update from Splunk site and uploading it directly to server(s).

Of course if you can directly use external services in inputs, external lookups, actions and so on but it's up to you.

Re: Required Internet Endpoints for Splunk SIEM Functionality

Nikolozts — Sat, 22 Mar 2025 07:21:47 GMT

Thank you. if a user wants to download apps from Splunkbase and install new updates, which internet endpoints need to be accessible?

Re: Required Internet Endpoints for Splunk SIEM Functionality

PickleRick — Sat, 22 Mar 2025 19:15:57 GMT

https://docs.splunk.com/Documentation/Splunk/latest/Admin/Serverconf#Remote_applications_configuration_.28e.g._SplunkBase.29

This section lists all URLs Splunk uses for listing apps from Spkunkbase and checking for updates.