Installation

Do Splunk Enterprise security upgrades result in a new AWS AMI being released?

mihaibarzu
New Member

My team is considering running Splunk Enterprise on EC2, and wants to understand the operational load we'll incur due to regular security upgrades.
Rather than go through the various manual steps each upgrade recommends, we were considering taking advantage of EC2's ASG, spinning up replacement capacity using the latest Splunk AMI and spinning down old capacity once the replacements are up. For this to work, each Splunk security upgrade should result in a new Splunk AMI being published.
1. Are new AMIs being published on all Splunk security upgrades, or only on major version upgrades?
1.1 If new AMIs are being published on all Splunk security upgrades, is there any delay between the vulnerability and fix being published and the new AMI being released?
1.2 If new AMIs are not being published on all Splunk security upgrades, then what happens on a fresh install of the Splunk AMI on an EC2 instance? Do all recent security patches need to be applied manually?

Labels (1)
0 Karma

PeterB2
Observer

Can we have an answer on that? thank you

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...