Best practices for Splunking mobile endpoints

[responsys_cm]

I'd just like to hear from anyone who has implemented a successful strategy for Splunking mobile endpoints (Windows, OSX, Linux...).

It would seem to me that since accelerated data models run every five minutes by default, capturing events from mobile endpoints would need to happen in <5 min window. So, having a Universal Forwarder that can only forward data when on a VPN, or physically connected to the corporate network seems like a losing strategy.

This would mean having some kind of intermediate forwarder and deployment server available to the Internet.

Has anyone tried this?

What kind of security controls and tools did you use to protect the Internet-facing Splunk infrastructure?

Thanks.

C

[TheSplunkDude]

Good question. I would be interested how this is done for off network systems.