Getting Data In

How do I convert HEC to SSL? (HTTP to HTTPS)

danielbb
Motivator

What do I need to change in order to convert HEC on HTTP to HEC on HTTPS?

Labels (1)
Tags (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

You must turn on TLS/SSL on hec configuration. I think that in cloud there is only https available, but in onprem you could use both but not at the same time in one node!
I this doc look enterprise part and enable ssl.
https://docs.splunk.com/Documentation/Splunk/9.4.0/Data/UsetheHTTPEventCollector
When you are using it then just use https instead of http as a protocol.
Earlier there was some requirements that TLS certificates must be official at least with some senders? I don’t know if this is still valid requirement or can you use private certificates also?

danielbb
Motivator

Thank you @isoutamo, I changed the global setting to HTTPS and it works perfectly fine. I just don't understand how it works, doesn't the sender need the public key? how does it work?

0 Karma

isoutamo
SplunkTrust
SplunkTrust

There haven’t been any requirements for specific client cert as HEC has planned to be “open” at this point of view. The real “authentication” has done with given token. In that way there is no need to share any TLS client certificates for source side.

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Actually, this is not entirely true.

1. With HEC the "basic" form of... well, it's not even authentication as such since the token is not very secret and is often used by many different sources, is a HEC token.

2. Additionally, you can limit source IPs from which the HTTP input accepts connections (the acceptFrom setting)

3. If you have TLS enabled you can use requireClientCert option to require the client to present a valid cert. By default this option is disabled so HEC can accept TLS connection from anyone (possibly with exception for clients not meeting the defined sslVersions or cipher suites).

4. Additionally to 3. you can limit accepted clients to only those presenting clients containing either sslCommonNameToCheck values or sslAltNameToCheck.

It's a relatively rarely used option since as @isoutamo said - typically HEC is a rather "open" input but the options are there.

I don't remember for certain but I think the 3. and 4. parameters can only be defined on a HEC input as a whole, not on a per-token basis.

Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Announcing the General Availability of Splunk Enterprise Security 8.1!

We are pleased to announce the general availability of Splunk Enterprise Security 8.1. Splunk becomes the only ...

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...