Getting Data In

Best practices for Splunking mobile endpoints

responsys_cm
Builder

I'd just like to hear from anyone who has implemented a successful strategy for Splunking mobile endpoints (Windows, OSX, Linux...).

It would seem to me that since accelerated data models run every five minutes by default, capturing events from mobile endpoints would need to happen in <5 min window. So, having a Universal Forwarder that can only forward data when on a VPN, or physically connected to the corporate network seems like a losing strategy.

This would mean having some kind of intermediate forwarder and deployment server available to the Internet.

Has anyone tried this?

What kind of security controls and tools did you use to protect the Internet-facing Splunk infrastructure?

Thanks.

C

Labels (1)

TheSplunkDude
Explorer

Good question. I would be interested how this is done for off network systems.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...