Getting Data In

How do I convert HEC to SSL? (HTTP to HTTPS)

danielbb
Motivator

What do I need to change in order to convert HEC on HTTP to HEC on HTTPS?

Labels (1)
Tags (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

You must turn on TLS/SSL on hec configuration. I think that in cloud there is only https available, but in onprem you could use both but not at the same time in one node!
I this doc look enterprise part and enable ssl.
https://docs.splunk.com/Documentation/Splunk/9.4.0/Data/UsetheHTTPEventCollector
When you are using it then just use https instead of http as a protocol.
Earlier there was some requirements that TLS certificates must be official at least with some senders? I don’t know if this is still valid requirement or can you use private certificates also?

danielbb
Motivator

Thank you @isoutamo, I changed the global setting to HTTPS and it works perfectly fine. I just don't understand how it works, doesn't the sender need the public key? how does it work?

0 Karma

isoutamo
SplunkTrust
SplunkTrust

There haven’t been any requirements for specific client cert as HEC has planned to be “open” at this point of view. The real “authentication” has done with given token. In that way there is no need to share any TLS client certificates for source side.

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Actually, this is not entirely true.

1. With HEC the "basic" form of... well, it's not even authentication as such since the token is not very secret and is often used by many different sources, is a HEC token.

2. Additionally, you can limit source IPs from which the HTTP input accepts connections (the acceptFrom setting)

3. If you have TLS enabled you can use requireClientCert option to require the client to present a valid cert. By default this option is disabled so HEC can accept TLS connection from anyone (possibly with exception for clients not meeting the defined sslVersions or cipher suites).

4. Additionally to 3. you can limit accepted clients to only those presenting clients containing either sslCommonNameToCheck values or sslAltNameToCheck.

It's a relatively rarely used option since as @isoutamo said - typically HEC is a rather "open" input but the options are there.

I don't remember for certain but I think the 3. and 4. parameters can only be defined on a HEC input as a whole, not on a per-token basis.

Get Updates on the Splunk Community!

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...

The Visibility Gap: Hybrid Networks and IT Services

The most forward thinking enterprises among us see their network as much more than infrastructure – it's their ...

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...