Archive

Data Integrity 6.3

DavidHourani
Super Champion

Hello,

Is there any way to activate data integrity via GUI in 6.3 ?

http://docs.splunk.com/Documentation/Splunk/6.3.0/Security/Dataintegritycontrol

Regards,
David

Tags (2)
0 Karma
1 Solution

ChrisG
Splunk Employee
Splunk Employee

I don't think there have been any changes to this feature in Splunk Enterprise 6.3.

View solution in original post

0 Karma

ChrisG
Splunk Employee
Splunk Employee

I don't think there have been any changes to this feature in Splunk Enterprise 6.3.

View solution in original post

0 Karma

DavidHourani
Super Champion

This feature has just been added no ? Apparently it can only be activated via CLI.

0 Karma

Lucas_K
Motivator

Its only via cli. It is also limited to only verifying file level buckets.

ie. it will only show if there has been no bucket tampering and nothing else (its not event level hashing so won't show if someone used the can_delete capability).

In the .conf 2015 technical session on this feature it was indicated that this is just the start of a frame work for allowing some higher data verification features (ie. event verification) to be added later. This is just the first step in adding these.