topic How to setup splunk on home wireless network? in Getting Data In

How to setup splunk on home wireless network?

splunkdavidh — Sun, 15 Mar 2020 05:47:01 GMT

I want to learn splunk.
How can I setup splunk on my home WiFi network to learn and practice?

I have Verizon router.
1-Laptop Windows 10
1-Laptop dual boot-Win 10/Kali Linux
2-Desktop PCs with Windows 10

Thanks in advance!

Re: How to setup splunk on home wireless network?

to4kawa — Sun, 15 Mar 2020 08:19:18 GMT

Can your network equipments send logs?

Re: How to setup splunk on home wireless network?

afx — Sun, 15 Mar 2020 15:44:41 GMT

Set up Splunk on one of the desktops.
Make sure there are Windows Security Events activated on the box.
Use them as an input.

Install Sysmon for file and other monitoring topics and include them as well.
See whether the router can Syslog data to the Splunk machine.

By now your are probably already getting more data per day than the free license allows.
If not, install universal forwarders on the other boxes and grab their logs as well.
Install a web server on one of the boxes and integrate the logs of the web server.
Of course, for playing, you might include the logs of various sources at different times so that your daily license is not blown.
Once you have the data in you can play with it.
Check out the relevant apps from splunkbase.
Look for old .conf talks on relevant topics.

That should keep you busy for a while 😉

cheers
afx

Re: How to setup splunk on home wireless network?

splunkdavidh — Sun, 15 Mar 2020 20:11:11 GMT

Thank you!
So basically I don't have to have any specific equipment to learn/practice splunk on my home WiFi network and I don't have to connect my computers to router via Ethernet to router, correct?

Re: How to setup splunk on home wireless network?

splunkdavidh — Sun, 15 Mar 2020 20:14:50 GMT

I am not really sure, but I guess I should be able to find out by looking at the specs of my router or logging into router interface.

Re: How to setup splunk on home wireless network?

afx — Mon, 16 Mar 2020 08:28:10 GMT

Yes, WiFi is good enough.
and as you do have aKali Maschine, you can hammer your other systems with lots if interesting stuff to create lots of events that you can play with.

I somtimes test things at home and I use Splunk Linux VM on my Windows Laptop to do this. All tha magic happens in that VM.

cheers
afx

Re: How to setup splunk on home wireless network?

niketn — Mon, 16 Mar 2020 09:03:25 GMT

@splunkdavidh learn about Splunk Stream App which allows you to monitor several protocols in streaming manner (caution monitor those which are needed and control frequency/duration for home test monitor as it will consume bandwidth as well as license for indexing).

Once you are familiar with Splunk Stream (Documentation is also available on Splunkbase), you can also check out Home Monitor app on Splunkbase (PS: I have not tested and not sure whether it is compatible with your network devices or not but do read the details before installing)

Re: How to setup splunk on home wireless network?

to4kawa — Mon, 16 Mar 2020 11:24:23 GMT

http://amiracle19.blogspot.com/p/setting-up-verizon-fios-router-for-home.html

I don't know this post is related what you want.