Hello,
There are a number of use cases where it is valuable for Splunk to process data from clients that are outside the network. For instance, Sysmon combined with a Splunk Universal Forwarder on the client is a useful way to gather valuable forensics data from systems that are more vulnerable because they are outside the perimeter defenses. But forwarding this data requires either a Splunk Enterprise Server or a Splunk Universal Forwarder being accessible outside the network.
I had a question about the default configurations for a Splunk Enterprise Server and Splunk Universal Forwarder. If I install Splunk on a Server OS that is properly hardened, are the default configurations for Splunk Enterprise and a Splunk Universal Forwarder sufficiently hardened for those instances of Splunk to run in the DMZ where it is easier for malicious actors to attempt to exploit them? Or are there aspects of the default configurations that assume the servers will not be easily accessible outside a secured perimeter?
Thanks for any input you can offer.
