All Apps and Add-ons

How to encrypt data stream between ProxySG and Indexer?

edekker
Explorer

Is it possible to encrypt the data stream between the ProxySG and the Indexer?

0 Karma

dwaddle
SplunkTrust
SplunkTrust

Maybe.

A quick googling shows that Blue Coat can send its syslog via tcp over an SSL link. Splunk can listen for a TCP input with SSL encryption. This "should work". See https://kb.bluecoat.com/index?page=content&id=KB4294 for the Blue Coat side of this. In Splunk, this is an inputs.conf stanza of type tcp-ssl.

Lukas Camenzind has blogged about this setup, including some of the SSL certificate issues he discovered, at http://www.looke.ch/wp/integrating-bluecoat-proxy-sg-access-logs-into-splunk

Another option (if the Blue Coat supports it) is IPSec. You could configure host-to-host IPSec and have all traffic between the two devices encrypted by the IP stack. However, I can find no evidence that Blue Coat can support this.

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with Brett Adams

In our third Spotlight feature, we're excited to shine a light on Brett—a Splunk consultant, innovative ...

Index This | What can you do to make 55,555 equal 500?

April 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Say goodbye to manually analyzing phishing and malware threats with Splunk Attack ...

In today’s evolving threat landscape, we understand you’re constantly bombarded with phishing and malware ...