UF in a lab VM

[armindorod]

Hi all, 

I am using Splunk Cloud and would like to configure a universal forwarder in a VM on a non-domain joined laptop. The goal is to run attacks and malware samples. As such, I will be using a VPN to mask my IP address which will not be associated with my cloud instance. My company has whitelisted IPs for access to the console. 

Will I be able to configure this or will the cloud firewall not allow logs to be ingested from a non company IP address? 

Thanks!

[inventsekar]

Hi @armindorod 

Question - I am using Splunk Cloud and would like to configure a universal forwarder in a VM on a non-domain joined laptop. The goal is to run attacks and malware samples. As such, I will be using a VPN to mask my IP address which will not be associated with my cloud instance. My company has whitelisted IPs for access to the console. 

Answer - i understand you want to use Splunk Cloud and send logs from a UF to Splunk Cloud. 

Question - Will I be able to configure this or will the cloud firewall not allow logs to be ingested from a non company IP address?

Answer - as @richgalloway also suggested, this is quite possible. Splunk Cloud can receive/ingest logs from any Splunk UF which got the right certificates. the IP maskings, whitelistings, etc are just internal to UF and Splunk Cloud need not know any info about these. 

Regarding the Cloud Firewall --- i think this is not needed for this particular requirement/use-case, as the UF itself can handle this. Cloud Firewall got some more features, you could use that in your other/future requirements/use-cases. thanks. 

[richgalloway]

IIRC, Splunk Cloud is open to any forwarder that has the right certificate.  The customer can, however, request an allow or deny list for connections so you may want to contact your company about that.