Are you a member of the Splunk Community?
- Find Answers
- :
- Splunk Administration
- :
- Deployment Architecture
- :
- Securing UF-IDX traffic using SSL/TLS in Splunk P...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
In the practical Lab environment, how important is it to configure TLS on Splunk servers during the practical Lab. Do i get penalized for not securing UF-IDX traffic using SSL/TLS
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@shabamichae In the Splunk Architect practical lab exam, configuring TLS/SSL for Universal Forwarder (UF) to Indexer (IDX) communication is not strictly required unless explicitly mentioned in the exam requirements. If the exam explicitly states that secure communication must be configured, then failing to implement SSL/TLS for UF-IDX traffic could result in deductions. Since time is limited, focus on core configurations (indexing, forwarding, clustering, search head deployment) first, then handle TLS if necessary.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@shabamichae In the Splunk Architect practical lab exam, configuring TLS/SSL for Universal Forwarder (UF) to Indexer (IDX) communication is not strictly required unless explicitly mentioned in the exam requirements. If the exam explicitly states that secure communication must be configured, then failing to implement SSL/TLS for UF-IDX traffic could result in deductions. Since time is limited, focus on core configurations (indexing, forwarding, clustering, search head deployment) first, then handle TLS if necessary.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This is not strictly true. According to the documentation "Participants then perform a mock deployment according to requirements which adhere to Splunk Deployment Methodology and best-practices." - SSL falls in to best-practice category here for both compression (for data transfer) and security benefits.
Whilst not including SSL between Splunk servers might not result in a failing the the lab, there isnt a zero chance that it wont deduct marks which could affect the final score/outcome. Remember that this is one of the prereqs to Core Consulting certification and at this point it is expected that candidates will apply configuration that is most suitable to the customer.
Splunk Lantern (great for some best-practice guidance) has a good page on SSL: https://lantern.splunk.com/Splunk_Platform/Product_Tips/Administration/Securing_the_Splunk_platform_...
You can also see more info on enabling SSL at https://docs.splunk.com/Documentation/Splunk/9.4.0/Security/StepstosecuringSplunkwithTLS
Please let me know how you get on and consider adding karma to this or any other answer if it has helped.
Regards
Will
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I’m not sure if this is exactly required or not.
Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform
Calling All Security Pros: Ready to Race Through Boston?
Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...
