Set Up More Secure Configurations in Splunk Enterprise With Config Assist

[adepp]

This blog post is part 3 of 4 in a series on Splunk Assist. Click the links below to see the other blog posts.

• Part 1: What is Splunk Assist?
• Part 2: Certificate Assist: Identify and Mitigate Certificate Expiry Issues
• Part 3: Config Assist: Set Up a More Secure Splunk Configuration 
• Part 4: App Assist: Keep Your Enterprise Apps Up-to-Date

In this blog post, we’ll dive into one of the features within Splunk Assist, called Config Assist.

First, What is Splunk Assist? 

(in case you missed it)

Splunk Assist is a free, cloud-connected service for Splunk Enterprise. Assist inspects your deployment for security risks, and using telemetry data sent to Splunk Cloud, provides cloud-powered insights and recommendations. 

It improves your security posture by helping identify unpatched applications, expiring TLS certificates, and insecure configuration settings. With Splunk Assist you’ll be given recommendations that you can act on immediately to make your deployment even more secure. Based on our initial estimates, the insights and recommendations in Assist may also help reduce admins’ efforts spent on platform management tasks by 25%.

What is Config Assist?

Config Assist helps you identify and apply more secure configurations to keep your environment safe. 

Do you wonder if your setup is the most secure it could be? Do you worry about when the newest vulnerability patch will come out, or when you should run another security check across all your nodes? Fret no more!

Config Assist displays a ranked list of over five security postures across seven *.conf files, along with actionable recommendations to fix those settings. The rankings include critical, warning and conforming, in order of most to least severe.

Check out the “security score” to see any configurations that need changing, copy-paste the automation/help text to fix the vulnerability, and you are good to go.

In the above picture, we see that of the 60 indicators in this deployment, 6 are critical and 6 have been issued a warning.

Config Assist scans and reports on 25+ security configuration parameters across multiple .conf files to help enhance your security posture for search heads and indexers. 

Additional Resources:

• Config Assist documentation
• Full detailed blog 
• Splunk Assist Tech Talk 

Questions or feedback? Contact the team at ssg-splunk-assist@splunk.com

— Baylie Depp, Product Marketing Manager

[Peterman]

Config Assist is one of the features offered within Splunk Assist, a free, cloud-connected service for Splunk Enterprise. Splunk Assist inspects your Splunk deployment for security risks and leverages telemetry data sent to Splunk Cloud to provide cloud-powered insights and recommendations.

Config Assist's primary purpose is to help users identify and apply more secure configurations to ensure the safety of their environment. It addresses concerns such as the security level of your setup, the availability of the newest vulnerability patches, and the need to run security checks across all nodes.

When using Config Assist, you'll be presented with a ranked list of over five security postures across seven *.conf files, along with actionable recommendations to fix any insecure settings. The rankings include critical, warning, and conforming levels, ordered from most severe to least severe. Also is it really related to SSL config that we use on any website.