Hello, I am looking for a solution to send Splunk alerts to Splunk mobile application. So far I was using the "Splunk Cloud Gateway" splunkbase on my Splunk lab (standalone Splunk VM) which was based on Splunk 8.0.x. Since I wanted to upgrade recently to Splunk 8.2.4, I needed to also move to the "embedded" Splunk Secure Gateway app. Since I did not needed the former indexed data, I decided to remove Splunk 8.0 and do a fresh install of 8.2.4 (no upgrade on Splunk side nor migration from Cloud Gateway to Secure Gateway). After "opt-in" for Secure Gateway, the gateway managed to stay "connected" for a duration of ~10 minutes (I can see "ping-pong" messages in Secure Gateway logs/_internal index). But it stopped suddenly to work (status in dashboard is now desperately showing  "not connected") ... Last "ping-pong" exchange is the following one: This was "today morning " at 0:20 AM (twenty past midnight, 10 minutes after gateway optin/config). On the errors side, the first one ever I can see is this one (7 min before 0:20 AM): Then this one when it stopped the "ping-pong" traffic (at 0:20 AM):  And then such ones:   I've checked all the logs of the gateway, enabled DEBUG traces, analyzed the python code, checked these errors, changed the "timeouts" for bigger values in the app conf file, looked at the "Troubleshooting sections" of the doc ... but I could not find yet why it suddenly stopped to work. To be complete, I am running on a lab VM (2 vCPU, 8GB of RAM) (which is under the prereq "specs", I know) and with SSL self-sign certificate generated by Splunk when I changed the server settings to use HTTPS. I am behind a Sophos UTM 9.7 which is protecting my home network and I've made a rule to disable filtering (like SSL scanning etc) for URLs that ends by *.spl.mobi  Would you have any directions or clues for fixing that connectivity issue? Thanks in advance    ... View more

Hello All, This is what we try to achieve: 1- In this Splunk document --> https://docs.splunk.com/Documentation/Splunk/7.3.3/Installation/ChoosetheuserSplunkshouldrunas, it is written that you need these Windows privileges to execute Splunk (in our case a Heavy Forwarder - HFs) on Windows platform in a general manner: a. Permission to log on as a service. b. Permission to log on as a batch job. c. Permission to replace a process-level token. d. Permission to act as part of the operating system. e. Permission to bypass traverse checking 2- We want to check if we can avoid granting some of these 5 privileges to the Windows user that will execute the Splunk Windows Heavy forwarder. Especially the most “critical ones” like “Permission to replace a process-level token”, “Permission to act as part of the operating system”, “Permission to bypass traverse checking” 3- The reason being that we want to reduce the “attack surface” of this Windows user that will execute Splunk (less “high” privileges this user have, less attack surface will exists). 4- Our particular use case in which we want to reduce these privileges is the following: a. Splunk Windows HFs will be installed and running on Windows servers configured as “Windows Event Collector” (WEC) servers (see https://docs.microsoft.com/en-us/windows/win32/wec/windows-event-collector) b. These WEC servers will collect Windows events from different Windows source machines (Windows 10 desktop/laptop endpoints, Windows servers like Exchange or SQL Server or …, Windows Domain Controllers, Windows DHCP or DNS servers, …) c. The Splunk HFs will only have to access and collect events forwarded by these different types of source machines to our WEC servers (with Splunk HFs running locally on these WEC servers) 5- Provided this very specific and pretty limited use case, we would like to know what are the minimum privileges the Windows user executing the Splunk HF process needs to access the WEC servers events “database” … Thanks in advance ... View more