Community Blog
Get the latest updates on the Splunk Community, including member experiences, product education, events, and more!

Set Up More Secure Configurations in Splunk Enterprise With Config Assist

adepp
Splunk Employee
Splunk Employee

This blog post is part 3 of 4 in a series on Splunk Assist. Click the links below to see the other blog posts.

In this blog post, we’ll dive into one of the features within Splunk Assist, called Config Assist.

First, What is Splunk Assist? 

(in case you missed it)

Splunk Assist is a free, cloud-connected service for Splunk Enterprise. Assist inspects your deployment for security risks, and using telemetry data sent to Splunk Cloud, provides cloud-powered insights and recommendations. 

It improves your security posture by helping identify unpatched applications, expiring TLS certificates, and insecure configuration settings. With Splunk Assist you’ll be given recommendations that you can act on immediately to make your deployment even more secure. Based on our initial estimates, the insights and recommendations in Assist may also help reduce admins’ efforts spent on platform management tasks by 25%.

What is Config Assist?

Config Assist helps you identify and apply more secure configurations to keep your environment safe. 

Do you wonder if your setup is the most secure it could be? Do you worry about when the newest vulnerability patch will come out, or when you should run another security check across all your nodes? Fret no more!

Config Assist displays a ranked list of over five security postures across seven *.conf files, along with actionable recommendations to fix those settings. The rankings include critical, warning and conforming, in order of most to least severe.

Check out the “security score” to see any configurations that need changing, copy-paste the automation/help text to fix the vulnerability, and you are good to go.

adepp_1-1670365028724.png

In the above picture, we see that of the 60 indicators in this deployment, 6 are critical and 6 have been issued a warning.

Config Assist scans and reports on 25+ security configuration parameters across multiple .conf files to help enhance your security posture for search heads and indexers. 

Additional Resources:

Questions or feedback? Contact the team at ssg-splunk-assist@splunk.com

— Baylie Depp, Product Marketing Manager

Peterman
Explorer

Config Assist is one of the features offered within Splunk Assist, a free, cloud-connected service for Splunk Enterprise. Splunk Assist inspects your Splunk deployment for security risks and leverages telemetry data sent to Splunk Cloud to provide cloud-powered insights and recommendations.

Config Assist's primary purpose is to help users identify and apply more secure configurations to ensure the safety of their environment. It addresses concerns such as the security level of your setup, the availability of the newest vulnerability patches, and the need to run security checks across all nodes.

When using Config Assist, you'll be presented with a ranked list of over five security postures across seven *.conf files, along with actionable recommendations to fix any insecure settings. The rankings include critical, warning, and conforming levels, ordered from most severe to least severe. Also is it really related to SSL config that we use on any website.

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...