Deployment Architecture

Splunk forwarder indexer communication

rangineniarunku
Explorer

How can splunk indexer avoid from receiving data, if a hacker is sending corrupt data from his local system through univ forwarder to Splunk Indexer by knowing indexer port and name of our envirenment????

Do we have any permissions to Univ forwarder or settings to avoid receiving data from unknown forwarders to our Indexer?

Tags (1)
0 Karma

woodcock
Esteemed Legend

I would handle this with ACL to block his connection attempts entirely but if firewalls cannot be used, then you can just /dev/null it like this on the Splunk Indexers:

In props.conf:

[host:Invader.IP.Address.Here]
TRANSFORMS-setnull = setnull

In transforms.conf:

[setnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

See more here:

http://docs.splunk.com/Documentation/Splunk/6.6.0/Forwarding/Routeandfilterdatad

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi rangineniarunkumar,

On the indexer you can set the acceptFrom = <network_acl> option in inputs.conf to a set of networks or addresses to accept connections from, see the docs for more details http://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf

A second option is to filter your events http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Keep_specific_even...
and only keep events from your known host for example.

Hope this helps ...

cheers, MuS

0 Karma
Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...