Installation

Which Vulnerable target should I install to Splunk Forwarder?

Mc_Guard
Explorer

Hello everyone. I installed Splunk Enterprise free edition on the Ubuntu machine. I want to install splunk forwarder on a vulnerable machine and deploy it to the Ubuntu machine. I want to attack the vulnerable machine over Kali linux and examine the logs falling to Splunk. Can you help me which vulnerable machine I can install Splunk Forwarder. 

Labels (2)
0 Karma
1 Solution

Gr0und_Z3r0
Contributor

Hi @Mc_Guard ,

In addition to what @richgalloway mentioned. Splunk will just be a tool to collect logs from any source that generates machine data. In terms of identifying machines for attacks and identifying and doing your pentest, I would recommend getting the images of vulnerable images from https://www.vulnhub.com/.

Please be sure on how and what you'll be doing it on and ensure you run these images in a sandboxed environment. You'll need to bake these images with Splunk Universal Forwarder depending on the OS type and configure the route to successfully send the event logs into your Splunk instance. 

Another thing to note, you'll need to know what kind of attack you'll be performing and where you'll be expecting those events/logs to be generated. As these are the paths you'll need to configure for the Splunk UF setup to forward the logs.

Note: Do not run these vulnerable images in cloud instances, there's a high chance it will be identified and reported and your account may be blocked. Better to run them on virtual boxes in a controlled sandbox environment.

~ If the reply helps, a Karma upvote would be appreciated.

View solution in original post

Gr0und_Z3r0
Contributor

Hi @Mc_Guard ,

In addition to what @richgalloway mentioned. Splunk will just be a tool to collect logs from any source that generates machine data. In terms of identifying machines for attacks and identifying and doing your pentest, I would recommend getting the images of vulnerable images from https://www.vulnhub.com/.

Please be sure on how and what you'll be doing it on and ensure you run these images in a sandboxed environment. You'll need to bake these images with Splunk Universal Forwarder depending on the OS type and configure the route to successfully send the event logs into your Splunk instance. 

Another thing to note, you'll need to know what kind of attack you'll be performing and where you'll be expecting those events/logs to be generated. As these are the paths you'll need to configure for the Splunk UF setup to forward the logs.

Note: Do not run these vulnerable images in cloud instances, there's a high chance it will be identified and reported and your account may be blocked. Better to run them on virtual boxes in a controlled sandbox environment.

~ If the reply helps, a Karma upvote would be appreciated.

Mc_Guard
Explorer

Thank you for sharing your experience and knowledge.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

All machines are vulnerable in some way so just install Splunk Forwarder on whatever you have available.  Whatever machine to select, be aware that Splunk and Splunk Forwarder do not detect vulnerabilities.  You can create reports in Splunk that report vulnerability information, but the vulnerabilities themselves must be detected by another program and reported to Splunk.

---
If this reply helps you, Karma would be appreciated.

Mc_Guard
Explorer

Thank you for sharing your experience and knowledge

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...