Getting Data In

What is the best practice for DB Connect TLS connections?

spl_aficionado
Path Finder

We struggled a bit to make the DB Connect connection using TLS. Apparently we have a choice between SQL Service and an AD Account. Is there a preferred way to set these TLS connections?

Labels (2)
Tags (1)
0 Karma

tscroggins
SplunkTrust
SplunkTrust

Hi @spl_aficionado,

Best (or better) practices depend on your organization's standards. Start with established benchmarks, e.g., CIS, for Microsoft Windows Server, Microsoft SQL Server, or whatever technologies your implementation uses. These benchmarks will cover authentication, authorization, TLS configuration, etc.

Prefer a custom configuration using the latest Microsoft JDBC Driver for SQL Server--currently 13.2.1-- over Splunk DBX Add-on for Microsoft SQL Server JDBC. The latter is out of date and uses a version of the JDBC driver with known vulnerabilities.

DB Connect should correctly configure the JDBC driver for TLS based on the options you select. If you need to edit the JDBC URL directly, connection properties for authentication, TLS/SSL, etc. are documented at https://learn.microsoft.com/en-us/sql/connect/jdbc/setting-the-connection-properties?view=sql-server....

If you're trying a specific configuration, and it isn't working, post a redacted copy of your connection string here alongside a summary of your SQL Server configuration, and we can debug it as needed.

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

A Four-Part Event Series: Full Stack Observability For the AI Era

As AI reshapes applications, infrastructure, and the way teams operate, the traditional boundaries of ...

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

AI has fundamentally raised the stakes for security operations, and this three-part series is your guide to ...