Getting Data In

Internet facing REST API

responsys_cm
Builder

We're looking to automate the process of uploading and approving files for an application whitelisting solution.

For machines that are outside the network, I would like them to periodically query a Splunk REST API that is Internet-facing. What is the best way to lock that down? Have an independent Splunk instance in the DMZ with a single saved search to run the query I want against the central server -- either as a search head or using its REST API?

How would one make that as secure as possible?

Thanks.

Craig

Tags (1)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

A great way to generally secure things is to not have internet-facing APIs at all, instead to establish a VPN or SSH tunnel and then to access the now "local" API.

0 Karma

araitz
Splunk Employee
Splunk Employee

I would advise putting the REST API behind a reverse proxy, which can help you load balance between many Splunk servers, provide centralized authentication, and perfom basic filtering and throttling.

0 Karma

responsys_cm
Builder

True. But that's another level of complexity. I want remote machines to poll the API for instructions. Scripting a VPN connection or SSH connection is complexity I'd prefer to avoid if I can lock the API down sufficiently.

0 Karma
Get Updates on the Splunk Community!

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...

4 Ways the Splunk Community Helps You Prepare for .conf25

.conf25 is right around the corner, and whether you’re a first-time attendee or a seasoned Splunker, the ...