Log collection off network devices

[adalbor]

Hey All,
Just curious if anyone is collecting logs from off network endpoints (workstations) using a Splunk UF and how it is setup?
I am aware you can secure communication via certs and SSL but was just looking for any details on anyone's setup for ideas and guidance.

Thanks!
Andrew

[mdsnmss]

I'd say this answer can be pretty broad. There are multiple ways to collect this sort of information without UFs (for example Windows Event Forwarding for Windows endpoints) but most prefer the UF on endpoints directly. This provides distribution and less of a single point of failure or bottleneck in the collection. It also depends on scale of number of endpoints you want to collect from.

I put UFs as part of my standard build. Every system that gets built receives a UF and an add-on that points the UF to a deployment server. Depending on scale you may want multiple deployment servers. From the deployment server it gets a default set of configs like outputs to indexers, inputs to define what to collect, etc. From there you have a default baseline that is easy to add stuff to if a certain host requires additional logs to be collected.

If you are looking for config specifics for stuff like SSL I'd start here:
1.) https://conf.splunk.com/session/2015/conf2015_DWaddle_DefensePointSecurity_deploying_SplunkSSLBestPr....
2.) https://docs.splunk.com/Documentation/Splunk/8.0.1/Security/AboutsecuringyourSplunkconfigurationwith...

Once you establish a repeatable method of joining your UF to the rest of your environment it mostly identifying what you want to collect and create baselines.

[adalbor]

Hey thanks for the info. We have the UF installed in our environment already and working fine.

My question revolved around collecting logs from workstation NOT on your network and NOT using VPN.

Was thinking along the lines of securing with SSL and using a load balanced public facing VIP (outputs.conf) specifically for these off network devices pointing to the IDX's

Just curious if anyone has done anything like this and whats best practice and gotchas.

[adalbor]

Anyone have any experience in this area?