topic Re: will server hardening (CIS redhat 9 level 1) break Splunk functionality? in Deployment Architecture

will server hardening (CIS redhat 9 level 1) break Splunk functionality?

tdth — Tue, 11 Feb 2025 02:03:53 GMT

I have splunk servers (full deployment with index cluster, sh cluster) running on redhat 9.

Now we want to harden the server following cis standard. Will this have any impact on Splunk application? Any exception need to be made?

Thanks

Re: will server hardening (CIS redhat 9 level 1) break Splunk functionality?

richgalloway — Tue, 11 Feb 2025 18:11:49 GMT

What specifically do you plan to do to harden the server? Once we know that, we can tell what effect it will have.

Re: will server hardening (CIS redhat 9 level 1) break Splunk functionality?

kiran_panchavat — Wed, 12 Feb 2025 08:18:46 GMT

@tdth

Yes, implementing CIS benchmarks to harden your Red Hat 9 servers can potentially impact your Splunk deployment if not carefully managed. What specific hardening measures are you planning to apply? It's best to first implement CIS hardening in a UAT environment and thoroughly test its impact before deploying it in production.

Re: will server hardening (CIS redhat 9 level 1) break Splunk functionality?

tdth — Sun, 23 Feb 2025 15:28:07 GMT

As I mentioned, we want to harden the Linux server following CIS benchmark. There is long list of things to be done so it's hard to put down everything here... The goal is to make the server and the application more secured

Re: will server hardening (CIS redhat 9 level 1) break Splunk functionality?

tdth — Sun, 23 Feb 2025 15:27:29 GMT

Thanks, I guess we have no choice but to test it out.

In your experience, what could be the impact to Splunk application?

Re: will server hardening (CIS redhat 9 level 1) break Splunk functionality?

richgalloway — Sun, 23 Feb 2025 16:57:59 GMT

There is a long list of things that potentially could go wrong depending on what you do to the server to harden it. It's hard to be specific about the results if you can't be specific about the changes. We're all volunteers here, so try to meet us halfway.