Splunk Enterprise

What are the pro's & Cons of connecting Splunk Enterprise & ES to Internet?

SamHTexas
Builder

Also is it advisable to leave them connected to internet only for short times for for example " Threat list" for Mittre-attack to gets downloaded? I get a lot of errors when updates don't get updated.

Labels (1)
Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

If you need Splunk connected to the Internet (and it sounds like you do) then leave it connected.

Pros: threat feeds arrive; alerts go out; update checking works; app updates work; less noise in the logs

Cons: "less secure"

---
If this reply helps you, Karma would be appreciated.

SamHTexas
Builder

Thank u again. As far as apps. I have about 80 apps & TAs that needs updating. My understanding is that I need to download the new ones & update the apps one at time. Am I right?

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

You are correct.  There are a couple of ways to update apps, but all of them require tedious manual clicking.  If you update from the Manage Apps page then Splunk does most of the work for you.

If your REST and programming skills are high enough then you may be able to automate the work.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...