topic Re: Small Deployment Splunk for SOC in Deployment Architecture

Small Deployment Splunk for SOC

gibranduatiga — Fri, 22 Mar 2019 07:52:07 GMT

Now I want to learn to make Splunk on a small scale for SOC, but before that, let me give you a picture of the topology that I will make at home.

It's topology is right to build? and is this possible to run accordingly?

https://ibb.co/kyXjPC9

For Details:
SH : 192.168.1.20
IDX : 192.168.1.21
UF1 : 192.168.1.30 | UF2 : 192.168.1.31 | HF1 : 192.168.1.32

Of all this, what I really need is to get data from snort.. I want to use Firegen for Snort App but that requires the help of the Splunk DB Connect App that I will install on HF. That way, later the DB Connect App will be connected toanyard2's MySQL in snort.

Please.. teach me and give me advice.. I want to learn more about Splunk.
Thank you

Links:

DB Connect App - https://splunkbase.splunk.com/app/2686/
Firegen for Snort App - https://splunkbase.splunk.com/app/4118/
Splunk Docs - https://docs.splunk.com/Documentation/DBX/3.1.4/DeployDBX/HowSplunkDBConnectworks
Firegen Readme File - https://pastebin.com/VDXkR71n

Re: Small Deployment Splunk for SOC

adonio — Sun, 24 Mar 2019 01:15:21 GMT

hello there,
plenty of information is missing, examples:
how much data (gp per day) do you plan to ingest?
what are the indexer and search head specs? (CPU, Memory, Disk)
how may concurrent users (searches) are you anticipating?
do you plan to scale in the future?

however, your overall topology makes sense and seems like a good start
good luck, and please share your progress and challenges and we would love to assist on your journey

hope it helps

Re: Small Deployment Splunk for SOC

gibranduatiga — Mon, 25 Mar 2019 00:33:10 GMT

I am sorry for late reply..

I want to process data as much as 20-50 GB per day.
for IDX & SH specifications for example:
Intel i7-5820K CPU 3.30GHz CPU
32GB RAM with RAID

for the future maybe I will add a scale to a larger one as the needs are needed.

by the way, what about dns loadbalance? do I have to implement it too?

thank you..... @adonio