Community Blog
Get the latest updates on the Splunk Community, including member experiences, product education, events, and more!

Set Up More Secure Configurations in Splunk Enterprise With Config Assist

adepp
Splunk Employee
Splunk Employee

This blog post is part 3 of 4 in a series on Splunk Assist. Click the links below to see the other blog posts.

In this blog post, we’ll dive into one of the features within Splunk Assist, called Config Assist.

First, What is Splunk Assist? 

(in case you missed it)

Splunk Assist is a free, cloud-connected service for Splunk Enterprise. Assist inspects your deployment for security risks, and using telemetry data sent to Splunk Cloud, provides cloud-powered insights and recommendations. 

It improves your security posture by helping identify unpatched applications, expiring TLS certificates, and insecure configuration settings. With Splunk Assist you’ll be given recommendations that you can act on immediately to make your deployment even more secure. Based on our initial estimates, the insights and recommendations in Assist may also help reduce admins’ efforts spent on platform management tasks by 25%.

What is Config Assist?

Config Assist helps you identify and apply more secure configurations to keep your environment safe. 

Do you wonder if your setup is the most secure it could be? Do you worry about when the newest vulnerability patch will come out, or when you should run another security check across all your nodes? Fret no more!

Config Assist displays a ranked list of over five security postures across seven *.conf files, along with actionable recommendations to fix those settings. The rankings include critical, warning and conforming, in order of most to least severe.

Check out the “security score” to see any configurations that need changing, copy-paste the automation/help text to fix the vulnerability, and you are good to go.

adepp_1-1670365028724.png

In the above picture, we see that of the 60 indicators in this deployment, 6 are critical and 6 have been issued a warning.

Config Assist scans and reports on 25+ security configuration parameters across multiple .conf files to help enhance your security posture for search heads and indexers. 

Additional Resources:

Questions or feedback? Contact the team at ssg-splunk-assist@splunk.com

— Baylie Depp, Product Marketing Manager

Get Updates on the Splunk Community!

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...