https://community.splunk.com/t5/Getting-Data-In/Best-practices-for-Splunking-mobile-endpoints/m-p/399454#M71161 <P>I'd just like to hear from anyone who has implemented a successful strategy for Splunking mobile endpoints (Windows, OSX, Linux...).</P> <P>It would seem to me that since accelerated data models run every five minutes by default, capturing events from mobile endpoints would need to happen in &lt;5 min window. So, having a Universal Forwarder that can only forward data when on a VPN, or physically connected to the corporate network seems like a losing strategy.</P> <P>This would mean having some kind of intermediate forwarder and deployment server available to the Internet.</P> <P>Has anyone tried this?<BR /><BR />What kind of security controls and tools did you use to protect the Internet-facing Splunk infrastructure?</P> <P>Thanks.</P> <P>C</P> Sat, 06 Jun 2020 23:58:21 GMT responsys_cm 2020-06-06T23:58:21Z https://community.splunk.com/t5/Getting-Data-In/Best-practices-for-Splunking-mobile-endpoints/m-p/399454#M71161 <P>I'd just like to hear from anyone who has implemented a successful strategy for Splunking mobile endpoints (Windows, OSX, Linux...).</P> <P>It would seem to me that since accelerated data models run every five minutes by default, capturing events from mobile endpoints would need to happen in &lt;5 min window. So, having a Universal Forwarder that can only forward data when on a VPN, or physically connected to the corporate network seems like a losing strategy.</P> <P>This would mean having some kind of intermediate forwarder and deployment server available to the Internet.</P> <P>Has anyone tried this?<BR /><BR />What kind of security controls and tools did you use to protect the Internet-facing Splunk infrastructure?</P> <P>Thanks.</P> <P>C</P> Sat, 06 Jun 2020 23:58:21 GMT https://community.splunk.com/t5/Getting-Data-In/Best-practices-for-Splunking-mobile-endpoints/m-p/399454#M71161 responsys_cm 2020-06-06T23:58:21Z https://community.splunk.com/t5/Getting-Data-In/Best-practices-for-Splunking-mobile-endpoints/m-p/399455#M71162 <P>Good question. I would be interested how this is done for off network systems.</P> Wed, 03 Jun 2020 16:49:06 GMT https://community.splunk.com/t5/Getting-Data-In/Best-practices-for-Splunking-mobile-endpoints/m-p/399455#M71162 TheSplunkDude 2020-06-03T16:49:06Z