This blog post is part 3 of 4 in a series on Splunk Assist. Click the links below to see the other blog posts.
- Part 1: What is Splunk Assist?
- Part 2: Certificate Assist: Identify and Mitigate Certificate Expiry Issues
- Part 3: Config Assist: Set Up a More Secure Splunk Configuration
- Part 4: App Assist: Keep Your Enterprise Apps Up-to-Date
In this blog post, we’ll dive into one of the features within Splunk Assist, called Config Assist.
First, What is Splunk Assist?
(in case you missed it)
Splunk Assist is a free, cloud-connected service for Splunk Enterprise. Assist inspects your deployment for security risks, and using telemetry data sent to Splunk Cloud, provides cloud-powered insights and recommendations.
It improves your security posture by helping identify unpatched applications, expiring TLS certificates, and insecure configuration settings. With Splunk Assist you’ll be given recommendations that you can act on immediately to make your deployment even more secure. Based on our initial estimates, the insights and recommendations in Assist may also help reduce admins’ efforts spent on platform management tasks by 25%.
What is Config Assist?
Config Assist helps you identify and apply more secure configurations to keep your environment safe.
Do you wonder if your setup is the most secure it could be? Do you worry about when the newest vulnerability patch will come out, or when you should run another security check across all your nodes? Fret no more!
Config Assist displays a ranked list of over five security postures across seven *.conf files, along with actionable recommendations to fix those settings. The rankings include critical, warning and conforming, in order of most to least severe.
Check out the “security score” to see any configurations that need changing, copy-paste the automation/help text to fix the vulnerability, and you are good to go.
In the above picture, we see that of the 60 indicators in this deployment, 6 are critical and 6 have been issued a warning.
Config Assist scans and reports on 25+ security configuration parameters across multiple .conf files to help enhance your security posture for search heads and indexers.
Additional Resources:
- Config Assist documentation
- Full detailed blog
- Splunk Assist Tech Talk
Questions or feedback? Contact the team at ssg-splunk-assist@splunk.com
— Baylie Depp, Product Marketing Manager
