All Apps and Add-ons
Highlighted

Does Splunk App for Stream support decrypting TLS connections?

Path Finder

I'm testing the Splunk App for Stream v6.1.0 with HTTP data and it seems to only support decrypting SSLv3 connections. As soon as I switch the SSLProtocol in Apache from SSLv3 to TLSv1.2 no data is captured. Chrome is throwing warnings for SSLv3 connections so I can't leave Apache set at SSLv3.

Tags (1)
0 Karma
Highlighted

Re: Does Splunk App for Stream support decrypting TLS connections?

Splunk Employee
Splunk Employee

App for Stream does support TLS 1.0, 1.1 and 1.2; however, not all ciphers are supported. In particular, only ciphers using RSA based key exchanges (not ephemeral) are supported. For Apache, you can disable ephemeral ciphers using:

SSLCipherSuite ALL:!ADH:!EDH:!EXP:!NULL

View solution in original post

Highlighted

Re: Does Splunk App for Stream support decrypting TLS connections?

Path Finder

Thanks. I had to update the line to include !ECDH.

SSLProtocol All -SSLv2
SSLCipherSuite ALL:!ADH:!EDH:!EXP:!NULL:!ECDH

0 Karma