All Apps and Add-ons

[AWS Trumpet] Kinesis Firehose (no Public IP Address)

willadams
Contributor

We have our SPLUNK instance in a private AWS VPC.  We also have a separate HEC cluster in a private AWS VPC (logical separation).  I need to collect AWS Security Hub events into my HEC but reading through the notes, it indicates that I need to use Project Trumpet which will in turn use Kinesis Firehose.  Kinesis Firehose requires a public IP which is something that we don't want to do (we have been using older methods for pulling GuardDuty in for example).  Is there a way to use Trumpet and collect the same logs without having to expose the HEC to the internet (I know this can be segregated by way of Security Groups etc.) but I am trying to find a solution so that I don' t have to do this.  

Labels (3)
0 Karma
Get Updates on the Splunk Community!

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Avoid Certificate Expiry Issues in Splunk Enterprise with Certificate Assist

This blog post is part 2 of 4 of a series on Splunk Assist. Click the links below to see the other ...

Using Machine Learning for Hunting Security Threats

REGISTER NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more ...