Archive
Highlighted

Data Integrity 6.3

SplunkTrust
SplunkTrust

Hello,

Is there any way to activate data integrity via GUI in 6.3 ?

http://docs.splunk.com/Documentation/Splunk/6.3.0/Security/Dataintegritycontrol

Regards,
David

Tags (2)
0 Karma
Highlighted

Re: Data Integrity 6.3

Splunk Employee
Splunk Employee

I don't think there have been any changes to this feature in Splunk Enterprise 6.3.

View solution in original post

0 Karma
Highlighted

Re: Data Integrity 6.3

SplunkTrust
SplunkTrust

This feature has just been added no ? Apparently it can only be activated via CLI.

0 Karma
Highlighted

Re: Data Integrity 6.3

Motivator

Its only via cli. It is also limited to only verifying file level buckets.

ie. it will only show if there has been no bucket tampering and nothing else (its not event level hashing so won't show if someone used the can_delete capability).

In the .conf 2015 technical session on this feature it was indicated that this is just the start of a frame work for allowing some higher data verification features (ie. event verification) to be added later. This is just the first step in adding these.