ES Content Updates for Critical Infrastructure

[mooredaCIP]

Good day. I work in a heavily regulated critical infrastructure environment. Our compliance change management requires us to consider baseline changes in a server system. Do Content Updates alter the baseline for the Splunk server onsite? We do not use cloud. Are there hash values that are checked when pushing the updates? We need to have the updates but I can't just open a whole change management process each time this has to be updated. I need assurance that critical infrastructure is considered in ES content updates. Thanks in advance. 

[livehybrid]

Hi @mooredaCIP 

If you are referring to the underlying Splunk server software itself, then No. Splunk ESCU only contains knowledge objects (configuration) and does not change any binaries relating to Splunk server.

In relation to the contents within ESCU which get updated - the version updates could modify content within the ESCU app in the "default" folder, so any changes or modifications to ESCU content applied in Enterprise Security will not be affected - as these changes are applied to the local directory which should not be affected by an update.

Generally when utilising Splunk ESCU you would clone a detection which would mean you take a copy of the ESCU knowledge object *at that point in time* - so again, these cloned searches would not be affected.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[mooredaCIP]

Great answer. Thank you. Yeah, CIP is such a pain in the butt but needed.