Getting Data In
Highlighted

Internet facing REST API

Builder

We're looking to automate the process of uploading and approving files for an application whitelisting solution.

For machines that are outside the network, I would like them to periodically query a Splunk REST API that is Internet-facing. What is the best way to lock that down? Have an independent Splunk instance in the DMZ with a single saved search to run the query I want against the central server -- either as a search head or using its REST API?

How would one make that as secure as possible?

Thanks.

Craig

Tags (1)
0 Karma
Highlighted

Re: Internet facing REST API

SplunkTrust
SplunkTrust

A great way to generally secure things is to not have internet-facing APIs at all, instead to establish a VPN or SSH tunnel and then to access the now "local" API.

0 Karma
Highlighted

Re: Internet facing REST API

Builder

True. But that's another level of complexity. I want remote machines to poll the API for instructions. Scripting a VPN connection or SSH connection is complexity I'd prefer to avoid if I can lock the API down sufficiently.

0 Karma
Highlighted

Re: Internet facing REST API

Splunk Employee
Splunk Employee

I would advise putting the REST API behind a reverse proxy, which can help you load balance between many Splunk servers, provide centralized authentication, and perfom basic filtering and throttling.

0 Karma