Required Internet Endpoints for Splunk SIEM Functionality

[Nikolozts]

hello,

Please write or send me document link which internet endpoints (URL, port) Splunk SIEM needs access to in order to function properly, download updates, apps, and anything else required for its normal operation.

[PickleRick]

On-prem Splunk does not _need_ anything from the internet to work correctly.

Some functionalities can be useful (like aforementioned updates for apps) but they are not obligatory and are often done different way around (manually downloading app/software update from Splunk site and uploading it directly to server(s).

Of course if you can directly use external services in inputs, external lookups, actions and so on but it's up to you.

[Nikolozts]

Thank you. if a user wants to download apps from Splunkbase and install new updates, which internet endpoints need to be accessible?

[PickleRick]

https://docs.splunk.com/Documentation/Splunk/latest/Admin/Serverconf#Remote_applications_configurati...

This section lists all URLs Splunk uses for listing apps from Spkunkbase and checking for updates.