Splunk Enterprise Security

How to get a Splunk Cloud Enterprise Security adaptive response (ping) to run on a local HF/UF/SH?

chaker
Contributor

Running Enterprise Security on Splunk Cloud, how can I get an adaptive response such as a ping to run on a local HF/UF/SH?

Labels (1)
Tags (1)
1 Solution

chaker
Contributor

chaker
Contributor

esix_splunk
Splunk Employee
Splunk Employee

Currently there is no direct fix for this. Splunk Cloud customers can currently run AR on other cloud based services, or you can create your own AR that would connect back to your onpremise deployment.

The later option does require a vetting process, and does have to adhere to guidelines as outlined here : http://dev.splunk.com/view/app-cert/SP-CAAAE85

One of the key take aways here, is that any type of outbound communication from Splunk Cloud has to be over SSL, and any credentials use for authentication cannot be stored in clear text.

I'd recommend building your integration via the Splunk Addon Builder (TA Builder) : https://splunkbase.splunk.com/app/2962/

Cheers

starcher
SplunkTrust
SplunkTrust

ES adaptive responses run on the ES search head. Not remotely executed on other systems.

0 Karma

chaker
Contributor

How does a Splunk Cloud customer, run adaptive responses on their internal network?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...