Security

Secure forwarded data with certificates.

allan_newton
Path Finder

Dear Members,

We have a peculiar problem, there are 3 regions from which we collect data. Each region data should maintain its own integrity for various purposes.

The indexers, search heads and primary deployment server are in the 4th region. Now we use a secondary deployment server in each region which poll to primary DS, the secondary DSs also act as HF to forward data to the common indexers in the 4th region.

Now the requirement is to secure the forwarded data using different certificates for each location. Server certificate could be same but the client certificates should be unique for each region.

Thanks in advance.

0 Karma

mattymo
Splunk Employee
Splunk Employee

You can create an app for each region that contains the proper config to use for that outputs.conf

https://docs.splunk.com/Documentation/Splunk/latest/Security/Aboutsecuringdatafromforwarders

Duane Waddle and George Starcher's talk is a great primer for this topic to help supplement Splunk docs:

https://wiki.splunk.com/images/f/fb/SplunkTrustApril-SSLipperySlopeRevisited.pdf
https://splunk.webex.com/splunk/lsr.php?RCID=da90ccae281af46da9e4a3b46c076a0b

Just ensure each zone's HF has the cert they need from the CA that the IDX wants and you should be ok. The idx will simply check the cert the HF has, but the IDX's cert is the one that secure comms.

- MattyMo
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...