Getting Data In

UF in a lab VM

armindorod
New Member

Hi all, 

 

I am using Splunk Cloud and would like to configure a universal forwarder in a VM on a non-domain joined laptop. The goal is to run attacks and malware samples. As such, I will be using a VPN to mask my IP address which will not be associated with my cloud instance. My company has whitelisted IPs for access to the console. 

Will I be able to configure this or will the cloud firewall not allow logs to be ingested from a non company IP address? 

Thanks!

Labels (2)
0 Karma

inventsekar
SplunkTrust
SplunkTrust

Hi @armindorod 

Question - I am using Splunk Cloud and would like to configure a universal forwarder in a VM on a non-domain joined laptop. The goal is to run attacks and malware samples. As such, I will be using a VPN to mask my IP address which will not be associated with my cloud instance. My company has whitelisted IPs for access to the console. 

Answer - i understand you want to use Splunk Cloud and send logs from a UF to Splunk Cloud. 


Question - Will I be able to configure this or will the cloud firewall not allow logs to be ingested from a non company IP address?

Answer - as @richgalloway also suggested, this is quite possible. Splunk Cloud can receive/ingest logs from any Splunk UF which got the right certificates. the IP maskings, whitelistings, etc are just internal to UF and Splunk Cloud need not know any info about these. 

Regarding the Cloud Firewall --- i think this is not needed for this particular requirement/use-case, as the UF itself can handle this. Cloud Firewall got some more features, you could use that in your other/future requirements/use-cases. thanks. 

 

Tags (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

IIRC, Splunk Cloud is open to any forwarder that has the right certificate.  The customer can, however, request an allow or deny list for connections so you may want to contact your company about that.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...