Monitoring Splunk

Need help with Event & Data Loss or Modification & where to enable / check Event IT data block signing. Thanks mills.


Need help hardening Splunk with the following brothers / sisters Thank u in advance.

Where do I enable Indexer Acknowledgement. To ensure delivery of data from FWs to Indexers. When enabled the FW will send any data not acknowledged as received by the Indexer.

Where do I enable Event & data block signing? To meet regulatory requirement. How do I ensure if Audit events & archives are cryptographically signed. To help detect any modifications or tampering of underlying data.

I appreciate your help in advance



Labels (1)
Tags (1)
0 Karma

Ultra Champion

Mate, why don't you hire some professional company to manage your Splunk for you? It's not that I'm trying to be mean to you. It's just that judging from your questions ranging from writing searches to splunk installation maintenance it seems that someone threw an existing installation on you and you're supposed to provide support on all layers of this setup. It's kinda non-efficient and counter-productive. Especially if you have additional regulatory obligations it's hard for you to maintain the proper posture.

So, get some external help, meanwhile invest in some training and then you'll be able to take care of your servers.


0 Karma
Get Updates on the Splunk Community!

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...