topic Is it possible to set TLS to only one input? in Getting Data In

Is it possible to set TLS to only one input?

joshuasolman — Fri, 10 Jun 2022 05:46:39 GMT

Is it possible to set TLS to only one input? For example:

Checkpoint --> TLS --> SC4S --> Splunk

CISCO ASA --> UDP514 --> SC4S --> Splunk

So far, i can only find information about enabling TLS for all, just wondering if i can set it per source.

Thanks!

Re: Is it possible to set TLS to only one input?

isoutamo — Fri, 10 Jun 2022 06:43:35 GMT

based on this Syslog Source Configuration You could enable TLS globally or by some default ports like 6514 etc. Have you done the 1st one or second configuration? Usually there are many devices which cannot use TLS, so it's better to enable TLS only on some default ports and leave tcp/514 and ump/514 without it.

r. Ismo

Re: Is it possible to set TLS to only one input?

joshuasolman — Fri, 10 Jun 2022 15:01:38 GMT

isoutamo, thank you for replying!

i think i was misunderstanding those options then assuming they were all grouped up. The first option would be to enable TLS globally, but you can leave that to default (no) and then enable the second option which would be to enable TLS receiver on whatever port you choose.

Am i right in that assumption?

Re: Is it possible to set TLS to only one input?

isoutamo — Fri, 10 Jun 2022 15:31:15 GMT

That is how I understand it.