Need help with Event & Data Loss or Modification & where to enable / check Event IT data block signing. Thanks mills.

[SamHTexas]

Need help hardening Splunk with the following brothers / sisters Thank u in advance.

Where do I enable Indexer Acknowledgement. To ensure delivery of data from FWs to Indexers. When enabled the FW will send any data not acknowledged as received by the Indexer.

Where do I enable Event & data block signing? To meet regulatory requirement. How do I ensure if Audit events & archives are cryptographically signed. To help detect any modifications or tampering of underlying data.

I appreciate your help in advance

[PickleRick]

Mate, why don't you hire some professional company to manage your Splunk for you? It's not that I'm trying to be mean to you. It's just that judging from your questions ranging from writing searches to splunk installation maintenance it seems that someone threw an existing installation on you and you're supposed to provide support on all layers of this setup. It's kinda non-efficient and counter-productive. Especially if you have additional regulatory obligations it's hard for you to maintain the proper posture.

So, get some external help, meanwhile invest in some training and then you'll be able to take care of your servers.