Aplura, LLC 4036 Wildwood Way Ellicott City, MD 21042 301-523-2110 (w) 410-64-36 (!)
Focused Information Security www.aplura.com
Splunk Best Practices "#$ r$co%%$&datio&' i& t#i' docu%$&t w$r$ co%pil$d y Aplura' 'ta!! o*$r t#$r$ %or$ t#a& 5-y$ar' o! +plu& ad%i&i'tratio& +plu& ad%i&i'tratio& a&d pro!$''io&al pro!$''io&al '$r*ic$' $&a$%$&t'. Ma&y o! t#$'$ it$%' co%$ up ti%$ a&d ti%$ aai& duri& $&a$%$&t' a&d co&'id$ratio& o! t#$'$ it$%' will r$'ult i& a %or$ 'ucc$''!ul i%pl$%$&tatio&. i%pl$%$&tatio&. A 'ucc$''!ul i%pl$%$&tatio& i' o&$ t#at i' $!!ici$&t, 'calal$, !ollow' i&!or%atio& '$curity $'t-practic$, a&d i', %o't i%porta&tly, u'$!ul. Alt#ou# $*$ryt#i& #$r$ i' *alual$, 'o%$ o! it do$' &ot apply !or *$ry '%all or 'p$ci!ic i%pl$%$&tatio&' o! +plu&. Lar$ly, %o't o! t#i' appli$' to %o't $&*iro&%$&t' w$ '$$.
Table of Contents Co%%o& +plu& "opoloy...............................................................................................................................2 Arc#it$ctur$ a&d D$'i& .................... ............................... ..................... .................... ..................... ..................... ..................... ..................... .................... .....................................2 ...........................2 /ardwar$ ..........................................................................................................................................................4 Data outi& ....................................................................................................................................................5 &put' ..................... ................................ ..................... .................... ..................... ..................... ..................... ..................... .................... ..................... ..................... ..................... ..................................5 .......................5 +y'lo &put .....................................................................................................................................................6 /i# $r!or%a&c$ +y'lo ..................... ............................... .................... ..................... ..................... ..................... ..................... .................... .......................................6 .............................6 Applicatio& or Data +p$ci!ic ..................... ................................ ..................... .................... ..................... ..................... ..................... ..................... ....................................... ............................. orward$r D$ploy%$&t .................................................................................................................................... Wi&dow' D$ploy%$&t ............................ .............. ............................. ............................. ............................ ............................ ............................ ............................. ........................... ............. . Li&u D$ploy%$&t ..................... ................................ ..................... .................... ..................... ..................... ..................... ..................... .................... ....................................... ............................. $r!or%a&c$ ..................................................................................................................................................... +$arc# /$lp ...................................................................................................................................................... +tora$ a&d Data Ma&a$%$&t .................... ............................... ..................... ..................... ..................... .................... ..................... ..................... ..................... ........................... ................ D$ploy%$&t +$r*$r .................... .............................. ..................... ..................... ..................... ..................... .................... ..................... ..................... ..................... ................................... ........................ App D$*$lop%$&t ..........................................................................................................................................10 A&alytic' ........................................................................................................................................................10 7+ Co&!iuratio& or /ard$&i& .....................................................................................................................10
Common Splunk Topology "#i' arc#it$ctur$ #a' '$*$ral $y co%po&$&t' 'uc# a'8 Multipl$ &t$r%$diat$ /$a*y orward$r' !or i&cr$a'$d load, /i# A*ailaility, a&d i%pro*$d 'p$$d o! proc$''i& i& co%i& $*$&t' A& &d$$r ti$r o! %ultipl$ 'y't$%'. Multipl$ '$arc#-p$$r' (i&d$$r') i%pro*$' p$r!or%a&c$ ot# duri& data-i&$'t a&d '$arc#. "#i' 'trat$y r$duc$' '$arc# ti%$ a&d pro*id$' 'o%$ r$du&da&cy o! datai&$'t '#ould a 'i&l$ '$r*$r !ail 7&$ or %or$ '$parat$ '$arc# #$ad'. "#i' '$parat$ 'y't$% will di'triut$ a&y '$arc# r$9u$'t acro'' all co&!iur$d '$arc#-p$$r' i%pro*$ '$arc# p$r!or%a&c$. A '$parat$ '$arc# #$ad i' '#ow& #$r$ to 'upport +plu&' E&t$rpri'$ +$curity (E+) applicatio& D$ploy%$&t +$r*$r. "#i' 'y't$% ca& $ collocat$d wit# ot#$r +plu& '$r*ic$', or 'ta&d-alo&$. or lar$ d$ploy%$&t', a 'ta&d-alo&$ 'y't$% i' i%porta&t.
Architecture and Design
la& i&d$$' a&d 'ourc$typ$'. "#$'$ two t#i&' will $ di!!icult to c#a&$ lat$r. &d$$' a&d 'ourc$typ$' a''i't i& data %a&a$%$&t. +$$ D$!ault!i$ld a&d &d$$d i$ld' :'$ 'ourc$typ$' to roup data y t#$ir 'i%ilarity. ! t#$ $*$&t' ar$ $&$rat$d y t#$ 'a%$ d$*ic$ a&d ar$ i& t#$ 'a%$ !or%at, t#$y '#ould %o't li$ly $ o&$ 'ourc$typ$. "ry to coll$ct $*$&t' a' clo'$ (i& t$r%' o! $orap#y a&d &$twor locatio&) a' po''il$. "#$'$ $*$&t' ca& $ coll$ct$d wit# a& Intermediate Heavy Forwarder , a&d t#$& '$&t to i&d$$r' w#ic# %ay $ a c$&tral locatio&. "ry to $$p '$arc# #$ad' a' clo'$ to i&d$$r' a' po''il$. "#i' will i%pro*$ t#$ '$arc# #$ad' 'p$$d i& acc$''i& t#$ $*$&t'. :'$ '$parat$ addr$''$' w#$&$*$r po''il$. +uc# a'8 %a&a$%$&t, lo coll$ctio&, w$ :;'$arc# #$ad a&d u'$ '$parat$ ' !or di!!$r$&t %a
POST-4.2 :'$ a +plu& Lic$&'$ Ma't$r to co&trol t#$ lic$&'i& o! your i&d$$r' a&d do&t !or$t to i&clud$ you '$arc# #$ad' a&d a&y #$a*y;!ull !orward$r' i& t#at lic$&'$. ! you ar$ i& a di'triut$d d$ploy%$&t, wit# %ultipl$ +plu& '$arc# #$ad', i&d$$r' or !orward$r', 'tro&ly co&'id$r u'i& D$ploy%$&t +$r*$r. :'i& d$ploy%$&t '$r*$r ca& #$lp $$p co&'i't$&t co&!iuratio& acro'' +plu& 'y't$%', a&d %a$ co&!iuratio& c#a&$' %uc# $a'i$r (&o #a*i& to touc# $*$ry 'y't$%). Car$!ully a&d co&'i't$&tly u'$ +plu&' li't$&i& port' w#ic# i&d to 'p$ci!ic ac-$&d proc$''$'. +o%$ o! t#$'$ ar$ r$!$r$&c$d w#$& +plu& 'tart'. =$&$rally 'p$ai& #$r$ ar$ t#$ 'ta&dard port', i! t#$y #a*$ &ot $$& alt$r$d8 ◾
•
•
• •
•
•
•
•
•
•
•
tcp;0 - 'plu&d - +plu&' da$%o& port u'$d !or di'triut$d '$arc# a&d d$ploy%$&t '$r*$r tcp;000 - 'plu&w$ - +plu&' w$ port u'$d !or w$ : acc$'' tcp; - 'plu&tcp li't$&$r - ort co%%o&ly u'$d to '$&d $*$&t' !ro% a +plu& !orward$r to a +plu& li't$&$r (i&d$$r or a&ot#$r !orward$r). >ot$8 "#i' ca& $ a&y p$r%i''il$ port, i'
la& your 4.2 %iratio&. "#$r$ ar$ %a&y &$w !$atur$' a&d $a&c$%$&t' i& +plu&-4.2 a&d a %iratio& to it !ro% pr$*iou' +plu& *$r'io&' warra&t car$!ul co&'id$ratio& a&d pla&&i&. la& your 4.3 %iratio&. "#$r$ ar$ %a&y &$w !$atur$' a&d $a&c$%$&t' i& +plu&-4.3 a&d a %iratio& to it !ro% pr$*iou' +plu& *$r'io&' warra&t car$!ul co&'id$ratio& a&d pla&&i&. $r!or% i&t$rity c#$c'. +plu& i' i&cr$dily pr$ci'$ i& #ow it coll$ct' a&d r$pr$'$&t' your data? #ow$*$r, i! you '$&d it ou' or duplicat$ data it %ay i&d$ t#i' a' w$ll. 7cca'io&ally r$*i$w your i&put' a&d $&'ur$ your data i' accurat$, ti%$ 'ta%p' ar$ ood, a&d t#$r$ ar$ &o %i'ta$' 'uc# a' i&corr$ct or duplicat$d $*$&t'. &t$rat$ AD !or aut#$&ticatio&. +plu& i&t$rat$' !airly w$ll wit# Acti*$ Dir$ctory to aut#$&ticat$ u'$r'. "#i' co&!iuratio& allow' you to a''i& a u'$r to a roup i& AD t#$& %ap t#i' roup to a role i& +plu&. W#$& t#i' u'$r lo' i& to +plu&, t#$y ar$ i*$& t#$ir 'p$ci!ic capailiti$' a&d ri#t' a''i&$d y t#$ rol$. "#i' i' ra&ular @AC (ol$ @a'$d Acc$'' Co&trol'). +$$ t#i' 't$p y-'t$p *id$o !or &t$rati& AD. "#$ M+ AD tool ad'i$dit.%'c i' r$at to row'$ a& AD do%ai& !or *alual$ it$%' &$c$''ary to '$tup AD aut# o& +plu&. "#i' tool i' i&'tall$d y d$!ault o& 200 AD 'y't$%', ut would &$$d to $ i&'tall$d %a&ually a' part o! t#$ +A" paca$ o& ot#$r *$r'io&' o! Wi&dow'. :'$ a '$parat$ 7: !or Acti*$ Dir$ctory &t$ratio&. W#$& co&!iuri& AD, you ca& 'p$ci!y a li't o! o&$ or %or$ i&droupD> !or +plu& to loo !or roup' i& AD. ! you to splunkgroups to %i&i%i$ r$tur&$d roup' a' w$ll a' u'$r' w#o #a*$ acc$'' to +plu&. Mirati& &d$ Data. "#i' ca& $ *$ry tricy a&d you &$$d to $ car$!ul 'i&c$ you could d$'troy a&d di'al$ your data. t i' ad*i'$d t#at you call +plu& 'upport or #a*$ + #$lp you. ! you %u't do t#i' %a&ually, r$ad a&d u&d$r'ta&d t#$ doc' a&d #ow t#$ uc$t 'tructur$ wor', a&d you ca& ta$ a loo at t#i' a&'w$r' po't o& t#$ 'u<$ct. A*oid par'i& raw data o& t#$ &d$$r'. Alt#ou# t#$ +plu& &d$$r i' p$r!$ctly capal$ o! par'i& raw data '$&t to it !ro% a :&i*$r'al orward$r or a &o&-+plu& 'ourc$ 'uc# a' 'y'lo, t#i' $!!ort could #a*$ a& u&d$'iral$ i%pact o& your p$r!or%a&c$ a&d ad%i&i'trati*$ o*$r#$ad 'uc# a' •
•
•
•
All$*iat$' par'i& load !ro% your Indexer allowi& it to !ocu' o& i&d$i& a&d r$tri$*i& $*$&t' Indexers #a*$ %or$ cod$, %or$ co%po&$&t';co&!iuratio&', a&d t#$r$!or$ o!t$& $t patc#$d %or$ !r$9u$&tly. A 'i%pl$ !orward$r %i#t &ot &$$d to $ patc#$d !or %o&t#' or %or$, %ai& it a %or$ 'tal$ plat!or% to r$c$i*$ u&r$lial$ 'y'lo data (:D) wit# %i&i%al lo''. "#$ +plu& !orward$r will store and forward $*$&t' w#$& t#$ i&d$$r i' dow& ($.. duri& a r$'tart) ! a& Indexer i' al'o par'i& raw data, t#$& you will #a*$ to %ai&tai& all o! your par'$ti%$ rul$' o& it a' w$ll. >ot o&ly ar$ t#$'$ additio&al co&!iuratio&' t#at your Indexer
•
•
•
%u't par'$ a&d #old i& %$%ory, ut t#$'$ ar$ co&!iuratio&' t#at you %u't %ai&tai& a' w$ll. Mo't par'$-ti%$ co&!iuratio&' r$9uir$ a r$'tart to %a$ $!!$cti*$, w#ic# could %$a& %or$ !r$9u$&t r$'tart' o! your &d$$r. +$$ t#$ it$% $low titl$d Intermediate Heavy Forwarder !or data i&$'t !or additio&al co&'id$ratio&'.
Intermediate Heavy Forwarder !or data i&$'t. Alt#ou# $&d-&od$' ca& '$&d t#$ir data dir$ctly to +plu& i&d$$r', i& a di'triut$d +plu& $&*iro&%$&t, a& &t$r%$diat$ /$a*y orward$r pro*id$' %a&y ad*a&ta$' 'uc# a'8 "wo or %or$ /$a*y orward$r' ca& $ u'$d !or !ault-tol$ra&t i&$'t o! i&co%i& data AutoL (Auto Load-@ala&c$) i&co%i& data acro'' t#$ +plu& &d$$r' $&'uri& t#at $al-ti%$ al$rt' will &$*$r !ail du$ to a 'i&l$-'$r*$r outa$ D$dicat$' 'y't$%' to t#$ ta' o! coll$cti& t#$ raw-data #$lpi& to $&'ur$ t#$ data $t' !orward$d o!! o! t#$ orii&al 'y't$% t#at $&$rat$d it ($.. A '$r*$r' wit# a :&i*$r'al orward$r o& it, 'uc# a' a M+ Ec#a&$ +$r*$r, 7racl$ Dataa'$, or M+ AD '$r*$r, or &tru'io& D$t$ctio& +y't$%) a' 9uicly a' po''il$ to %i&i%ally i%pact t#at critical 'y't$%. ar'$' t#$ raw data %i&i%ii& t#$ wor;$!!ort t#at %u't $ do&$ y t#$ &d$$r' "$r%i&at$' t#$ "C co&&$ctio&' !ro% t#$ %a&y :&i*$r'al orward$r' %i&i%ii& t#$ wor;$!!ort t#at %u't $ do&$ y t#$ &d$$r'. >ot$, t#i' al'o #a' a dra%atic a!!$ct i& t#$ restart ti%$ o! a 'y't$%. ! a 'y't$% #a' to t$r%i&at$ do$&', #u&dr$d' or $*$& t#ou'a&d' o! "C '$''io&' !ro% co&&$ct$d !orward$r' it could ta$ 10 %i&ut$' !or a r$'tart. /a*i& t#$ Intermediate Heavy Forwarder t$r%i&at$ t#$'$ '$''io&' a&d &ot t#$ Indexers %$a&' t#at w#$& t#$ Indexers do a r$'tart, t#$y ca& co%$ ac o&li&$ %uc# %or$ 9uicly. ro*id$' a %or$ cl$ar;li&$ar !low o! data to t#$ &d$$r'. "#i' could $ u'$!ul i& %a&y way' ut $'p$cially to 'upport data coll$ctio& !ro% a r$%ot$ locatio&. &d$-ti%$ co&!iuratio& c#a&$' ca& $ appli$d to t#$ Intermediate Heavy Forwarder a&d t#$r$!or$ you ar$ &ot co&'ta&tly r$'tarti& t#$ &d$$r' and lo'i& *alual$ 'u%%ary data. •
•
• •
•
•
Hardware •
•
Information8 "o 'p$c out #ardwar$ wit# +plu& r$9uir$' %or$ t#a&
•
•
•
•
• •
•
C: +p$c. C: i' 'o%$w#at *ari$d d$p$&di& o& w#at co%po&$&t you ar$ tali& aout. or i&d$$r', t#$ curr$&t 'w$$t 'pot !or '$r*$r' #a' $$& t#$ -12 cor$ %ac#i&$' (.$. dual 'oc$t 9uad or 'i cor$ oard'). +plu& ca& wor wit# $it#$r AMD or &t$l arc#it$ctur$ o& 6 'y't$%'. M$%ory +p$c. M$%ory i' 'o%$w#at *ari$d d$p$&di& o& w#at co%po&$&t you ar$ tali& aout. =$&$rally 'p$ai& i&d$$r' do particularly w$ll wit# 16 =@ o! %$%ory, %$a&w#il$ ot#$r co%po&$&t' %i#t r$9uir$ l$''. +cal$ y addi& %or$ &d$$r'. & a w$ll-co&!iur$d di'triut$d +plu& $&*iro&%$&t, you ca& 'cal$ 'i%ply y addi& %or$ i&d$$r'. "#$ Intermediate Heavy Forwarder ca& !orward data to t#$ &$w i&d$$r, a&d your '$arc# #$ad' will r$9u$'t data !ro% t#$ &$w i&d$$r. =$&$rally 'p$ai&, t#i' 'cal$' li&$arly r$'ulti& i& a 'ituatio& w#$r$ doul$ t#$ i&d$$r' cut' t#$ '$arc# ti%$ i& #al!. M$t#odically pla& 'tora$ &$$d' !or a &$w d$ploy%$&t, prior to i%pl$%$&tatio&. Dri*$ 'p$$d %a$' a di!!$r$&c$. +plu& #a' i&!or%ally docu%$&t$d t#at a& i&cr$a'$ i& dri*$-'p$$d will #a*$ a dra%atic i%pro*$%$&t o& p$r!or%a&c$. Arc#it$ctur$ typ$. +plu& wor' w$ll wit# ot# 32 a&d 64 it plat!or%'? #ow$*$r, t#$r$ i' a co&'id$ral$ p$r!or%a&c$ i%pro*$%$&t !or 64 it a&d t#i' '#ould $ '$l$ct$d (ot# !or /ardwar$ a&d 7p$rati& +y't$%) w#$&$*$r po''il$.
Data Routing
•
•
•
Information: Data routi& allow' t#$ +plu& ad%i&i'trator to '$l$cti*$ly d$t$r%i&$ w#at i&co%i& data $t' i&$'t$d, w#at $t' !orward$d, a&d w#at $t' dropp$d.
Drop i&co%i& data wit# t#$ &ullHu$u$. @$war$ &ot to o null!ueue-#appy a&d drop too %uc#. Ma&y $*$&t' w#il$ i&'i&i!ica&t y t#$%'$l*$' pro*id$ u'$!ul i&!or%atio& w#$& tr$&d$d or ot#$rwi'$ a&aly$d. orward to a +plu& 'y't$% w#$&$*$r po''il$, ut i! t#$r$ i' a :'$ Ca'$ to '$&d to a& $t$r&al 'y't$%, !ollowi& t#$'$ i&'tructio&' to orward data to t#ird party 'y't$%'. @$war$ t#$r$ ar$ 'o%$ ca*$at' o! doi& t#i'. :'$ +plu& AutoL@ (Load @ala&ci&) to di'triut$ data to %ultipl$ i&d$$r';!orward$r'. Muc# o! t#i' co&!iuratio& %u't $ do&$ wit# t#$ output'.co&! !il$.
Inputs
E&'ur$ all critical 'y't$%' #a*$ co&'i't$&t ti%$ co&!iuratio&. +y't$%' $&$rati& $*$&t' '#ould #a*$ t#$ prop$r ti%$ to $&'ur$ t#$ $*$&t' t#$y cr$at$ will $ al$ to $ corr$lat$d w#$& a&aly$d. Co&'id$r >" u'$ t#rou#out t#$ $&t$rpri'$ a' w$ll a' !r$9u$&t ti%$ audit' o! t#$ %o't critical 'y't$%' to $&'ur$ accuracy. Co&'id$r doi& r$ular time-audits. "#i' i' w#$r$, you $*aluat$ t#$ ti%$ o! your %o't critical 'y't$%' to $&'ur$ t#$y ar$ co&'i't$&t. ! t#$ data i' i& +plu&, t#$& t#i' ta' %i#t
•
•
•
•
•
"oo %a&y !il$'. E&'ur$ a 'i&l$ i&'ta&c$ o! +plu& do$' &ot %o&itor %or$ t#a& a !$w #u&dr$d acti*$ !il$'. ! t#$r$ ar$ %or$ t#a& t#i', co&'id$r i%pl$%$&ti& a proc$'' (i.$. cro&) to %o*$ t#$ pr$*iou' day' (or w$$ p$r#ap') 'y'lo dir$ctory out o! t#$ %o&itor$d dir$ctory-'tructur$ to a& arc#i*$ locatio&. Gou &ow you #a*$ a prol$% wit# too %a&y !il$' i! t#$ +plu& i&'ta&c$ i&*ol*$d #a' 'o%$t#i& li$ t#i' i& it' lo'8 File descriptor cache is full . Gou %i#t al'o $&$!it #$r$ y i&cr$a'i& t#$ ulimit ('$$ Ad"ust ulimit i& t#i' docu%$&t). A*oid o*$rwriti& or #ard-codi& t#$ 'ourc$ !i$ld i& t#$ data. Doi& 'o ca& %a$ troul$'#ooti& prol$%atic i&put' %or$ di!!icult.
Syslog Input
+trip priority out o! #$% i&put'. & accorda&c$ wit# C3164 a +y'lo priority %$''a$ i' pr$p$&d$d to $ac# 'y'lo $*$&t. @y d$!ault, +plu& will 'trip t#i' out o& i&co%i& &'% '$$ i&put'.co&! docu%$&tatio& r$ardi& t#$ no(priority(stripping dir$cti*$. "#$ prol$% i', t#at %a&y d$*ic$' 'till pr$p$&d t#i' priority w#$& '$&di& $*$&t' *ia #$% . +plu& $p$ct' t#$ $*$&t' to $ )F$-compliant a&d &ot co&tai& t#$ priority 'o do$' &ot &ow to r$%o*$ it. /$r$ i' a& $a%pl$ o! w#at a& $*$&t loo' li$8
<30>Sep 29 09:41:51 192.168.250.7 named[19706]...
"o 'trip t#i' out, add t#$ !ollowi& to t#$ appropriat$ 'ta&a o! t#$ prop'.co&! !or t#$ tar$t 'ourc$typ$8
SEDCMD-pri!rip"#$<[0-9]%>##
Watc# out !or c#ai&$d 'y'lo ti%$ 'ta%p'. ! a& $*$&t i' r$lay$d t#rou# %ultipl$ 'y'lo '$r*$r' (!or $a%pl$ t#$ local 'y'lo o& a Li&u 'y't$% '$&di& $*$&t' to a r$%ot$ 'y'lo '$r*$r), t#$r$ %ay $ two ti%$ 'ta%p' at t#$ 'tart o! t#$ $*$&t. Car$!ully co&!iur$ your +plu& prop'.co&! to $&'ur$ t#$ corr$ct ti%$ 'ta%p i' $tract$d !or t#$ $*$&t.
High Performance Syslog "#$ Li&u :D i&put u!!$r #a' a !i$d a%ou&t o! %$%ory allocat$d to it. W#$& t#$ a%ou&t o! i&co%i& data $c$$d' t#i' u!!$r, pac$t' ar$ dropp$d. 7& a *$ry u'y '$r*$r, t#i' could #app$& !r$9u$&tly or i& 'o%$ ca'$' co&ti&ually. "#$ %$%ory allocat$d to t#$ :D i&put u!!$r i' di'triutio&-'p$ci!ic. "#i' %$a&', t#at d$p$&di& o& your !la*or;*$r'io& o! Li&u, t#i' u!!$r 'i$ ca& *ary. @$ 'ur$ to u&d$r'ta&d w#at it i', a&d #ow it op$rat$'. +y'lo 'y't$%' '#ould $ t$'t$d a&d tu&$d to p$r!or% a' &$$d$d. •
Information8 Calculat$ Capacity y M$''a$' %ai&$ a d$*ic$ t#at $&$rat$' %$''a$' t#at ar$ 250-450 yt$' wit# %o't $i& o*$r 350. ! w$ a*$ra$ co&'$r*ati*$ly t#at t#$ %$''a$' ar$ 400 yt$' i, #ow %a&y E+ could $ proc$''$d $!or$ 'aturati& #al! t#$ li& 'uc# a' i& t#$ Syslog-*+ ,xample $low A 100;%' li& i' capal$ o! 100000000;B12500000 yt$';'$c /al! o! t#i' i' 6250000 (w#at t#$ +y'lo-& !ol' could do) Di*id$ t#i' y 400 (a*$ra$ yt$';%$''a$) a&d you $t 15625 w#ic# i' t#$ total a%ou&t o! %$''a$' w$ could po''ily r$c$i*$ i! opti%ally co&!iur$d wit# tcp i*$& t#$ para%$t$r'. +y'lo->= Ea%pl$ "#$ 'y'lo-& d$*$lop$r' #a*$ a lo w#$r$ t#$y di'cu'' po''il$ *olu%$' wit# t#$ 2.0 7+E8 100%' &$t "C %$''a$' 44000 %$''a$';'$c all 150 yt$' lo& "#i' %$a&' t#$y ar$ proc$''i& 44000I150B6600000 yt$' p$r '$co&d Multiply 6600000I to $t a&dwidt#8 52,00,000 +o 'y'lo-& opti%ally co&!iur$d (y it' d$*$lop$r) ca& u'$ aout #al! o! t#$ 100;%' Et#$r&$t co&&$ctio& wit#out droppi& pac$t' Information8 Calculat$ Capacity y Lic$&'$ +i$ %ai&$ a 50=@ lic$&'$ •
•
• • •
•
•
• • •
• • •
•
•
•
Di*id$ y '$co&d' p$r day 6400 to '$$ a& a*$ra$ o! #ow %uc# data could $ pu'#$d t#rou# t#$ &$twor o& a*$ra$8 50000000;6400B5 (yt$';'$co&d) Di*id$ t#$ ao*$ y to $t it' p$r yt$' (50000000;6400)IB4624 (it';'$co&d) •
•
•
Application or Data Specific
•
+E Data i%port. or +y%a&t$c E&dpoi&t rot$ctio&, you ca& put t#$ +E '$r*$r i& a co&!iuratio& w#$r$ it will writ$ out t$%p !il$' t#at a +plu& :&i*$r'al orward$r ca& r$ad. /$r$ i' t#$ +y%a&t$c &owl$d$-a'$ docu%$&t o& #ow to co&!iur$ t#i'. W#il$ it i' po''il$ to co&!iur$ +E to '$&d data *ia 'y'lo, i& 'o%$ ca'$' t#i' data i' i&co%pl$t$, a&d u&r$lial$. Ci'co ro&ort /$lp +plu& ro&ort App +plu& ro&ort Mail Add-o& Jid$o o& #ow to u'$ t#$ ro&ort App A*oid r$adi& Wi&dow' raw EJ"(K) !il$' i! at all po''il$. &'t$ad, Co&!iur$ a +plu& Forwarder to acc$'' indows ,vent anager dir$ctly to i&$'t Wi&dow' E*$&t'. ! your u'$ ca'$ r$9uir$' dir$ct r$ad' o! t#$ Wi&dow' EJ"(K) i&ary !il$' t#$& co&'id$r t#$ !ollowi& i&!or%atio&8 EJ"(K) !il$' ar$ t#$ raw i&ary-!or%at !il$' t#at Wi&dow' u'$' to 'tor$ it' lo' o& t#$ !il$-'y't$%. "#$'$ !il$' ar$ &ot#i& li$ &or%al lo !il$' a&d t#$r$!or$ pr$'$&t 'o%$ c#all$&$' to a&y att$%pt to r$co&'titut$ t#$% ac i&to u'al$ lo' (>ot$8 "#$'$ i''u$' #a*$ &ot#i& to do wit# +plu&)8 "#$y r$!$r$&c$ =:D;+D' i& li$u o! 'y't$%;u'$r &a%$'. "#i' %$a&' t#at t#$ EJ"(K) il$ ar'i& /o't %u't #a*$ acc$'' to %a$ AD 9u$ri$' to t#$ Do%ai& Co&troll$r' t#at ca& pro*id$ d$tail' a&d co&*$rt t#$ cod$' r$!$r$&c$d y t#$ Loi& /o't. "#$y r$!$r$&c$ DLL !il$' t#at co&tai& t#$ p$rti&$&t i&!or%atio& i&'t$ad o! placi& it i& t#$ actual lo. "#i' %$a&' a&y DLL r$!$r$&c$d y t#$ Loi& /o't M:+" $ a*ailal$ o& t#$ EJ"(K) il$ ar'i& /o't i& ord$r to i&t$rpr$t t#$ lo'. +i&c$ t#$ EJ"(K) !il$' ar$ a 'u'$t o! t#$ i&!or%atio& t#$y r$pr$'$&t, a M@ EJ"K !il$ co&*$rt' to al%o't 500M@ o! i&d$$d data. "#$r$ ar$ "@ o! lo' 'tor$d o& t#$ C+ '#ar$. "#$ *olu%$ ot# to t#$ +plu& lic$&'$, 'y't$% 'tora$, a&d AD;DC call' '#ould $ co&'id$r$d $!or$ !ully-i&t$rati& t#i'. &$'t ti%$ i' 'low 'i&c$ %a&y AD call' ar$ &$c$''ary !or =:D;+D 9u$ri$'. & our t$'t', %a&y =:D' a&d 'o%$ DLL r$!$r$&c$' did&t co&*$rt i& t#$ $*$&t lo', l$a*i& lot' o! u'$l$'' $*$&t'. "#i' %ay $ a r$'ult o! $it#$r i&co&'i't$&t AD d$tail' or %i''i& DLL' o& t#$ Lo ar'i& /o't +plu& o& Wi&dow' ca& &ati*$ly i&$'t EJ"(K) !il$' +plu& E&t$rpri'$ +$curity %pl$%$&tatio& Ad
•
•
•
•
•
•
• •
•
•
•
•
•
•
•
•
Forwarder Deployment C#a&$ t#$ ad%i& pa''word o& !orward$r'. All +plu& 'y't$%' #a*$ a d$!ault u'$r&a%$ o! admin a&d pa''word o! changeme a&d t#i' i&clud$' orward$r' (:&i*$r'al orward$r' a&d ull orward$r'). "a$ ti%$ to la& your d$ploy%$&t prior to i%pl$%$&tatio& to $&'ur$ t#$ %o't 'ucc$''. •
•
C$&trally-%a&a$ +plu& co&!iuratio&'. E&'ur$ you #a*$ a way to co&'i't$&tly a&d accurat$ly %a&a$ co&!iuratio&' acro'' t#$ $&t$rpri'$, 'uc# a' wit# t#$ +plu& d$ploy%$&t '$r*$r Information8 Co&!iur$ D$ploy%$&t +$r*$r Information8 D$!i&$ +$r*$r Cla''$' Information8 Co&!iur$ D$ploy%$&t Cli$&t' Information8 D$!i&$ D$ploy%$&t App' Information8 D$ploy%$&t Ea%pl$ • • • • •
Windows Deployment • • • • •
Information8 Cu'to% E*$&tLo' o& +plu& !or Wi&dow' ar$ di'cu''$d #$r$. @$!or$ acti*ati& +plu& Wi&dow' orward$r' co&!iur$ cu'to% i&d$$' Information8 Mo&itor !il$' a&d dir$ctori$' Wi&dow' D$ploy%$&t /$lp +cript$d d$ploy%$&t !or Wi&dow' :'. Gou ca& 'cript your d$ploy%$&t o! :&i*$r'al orward$r' !or Wi&dow' d$p$&di& o& w#at tool' you #a*$ a*ailal$ at your di'po'al. "#$r$ ar$ a !$w t#i&' to $$p i& %i&d t#ou# 'uc# a'8 7& a *$r'io& wit# :AC (:'$r Acc$'' Co&trol') 'uc# a' Ji'a, 200 or Wi&dow' , you %u't $ i& a& ad%i& '#$ll to i&'tall 'o!twar$ Alt#ou# it i' %uc# $a'i$r to #a*$ t#$ +plu& M+ !il$' i& a :>C t#at you ca& %ou&t;r$ac# !ro% a&y 'y't$%, 'o%$ti%$' wi&dow' '$curity policy pr$*$&t' t#i' !ro% wori&. ! %'i$$c i' !aili& co&'id$r copyi& t#$ M+ i&'tall$r local a&d try it aai&. "#$r$ ar$ a !$w t#i&' to $$p i& %i&d t#ou#, 'p$ci!ically t#at you wa&t to pa'' t#$ !ollowi& msiexec aru%$&t'8 A=EE"7LCE>+E, >+"ALLD ('i&c$ %a&y 'it$' wa&t to i&'tall to 'o%$ dri*$ $'id$' c @$low i' a& $a%pl$ co&t$&t t#at you ca& put i& a 'cript;paca$-%a&a$%$&t a&d it i' a'$d o& #a*i& a +plu& d$ploy%$&t '$r*$r i& plac$ •
•
•
•
mie&e' #i (()!em(*are(pa!*(p+,n/rarder-4.3 DEMESEE";DS-*/!/r:8089; ( =EECESE"e S=D";':(r/?ram @i+e(Sp+,nAniBera+@/rarder; M=ESA"1 (,ie!
Linux Deployment
+cript$d d$ploy%$&t !or Li&u :'. Gou ca& 'cript your d$ploy%$&t o! :&i*$r'al orward' !or Li&u d$p$&di& o& w#at tool' you #a*$ a*ailal$ at your di'po'al. "#$r$ ar$ a !$w t#i&' to $$p i& %i&d t#ou#, 'p$ci!ically t#at you proaly wa&t to pa'' t#$ !ollowi& +plu& 'tart-ti%$ aru%$&t'8 --acc$pt-lic$&'$, --a&'w$r-y$', --&o-pro%pt @$low i' a& $a%pl$ co&t$&t t#at you ca& put i& a 'cript;pupp$t;rp% a&d it i' a'$d o& #a*i& a +plu& d$ploy%$&t '$r*$r i& plac$. >ot$8 t#at t#i' #ard-cod$' a dow&load' o! t#$ +plu& : M at $ac# i&*ocatio&. t would $ %uc# '%art$r to u'$ a local r$po a&d r$plac$ t#at portio& o! t#$ 'cript wit# a call to t#i' locatio& wit# 'o%$t#i& 'i%pl$ li$8 yum install splunkforwarder
,name -a e'*/ SAME";#/p!#p+,n/rarder; ?e! - p+,n/rarder-4.3-115073-+in,&-2.6-&8664.rpm ( F*!!p:##.p+,n.'/m#inde&.p*p#d/n+/ad!ra'G i+e"4.3#,niBera+/rarder#+in,p+,n/rarder-4.3-115073-+in,&-2.6&8664.rpmHa'"H?e!"!r,eHname"?e!F rpm -AB* .#p+,n/rarder-4.3-115073-+in,&-2.6-&8664.rpmI e'*/ -e F[!ar?e!-Jr/er:dep+/)men!SerBer](n!ar?e!Ari " SA.DEME.SEE.S=ME/r:8089F > KSAME#e!'#)!em#+/'a+#dep+/)men!'+ien!.'/nI KSAME#Jin#p+,n re!ar! --a''ep!-+i'ene --aner-)e --n/-
KSAME#Jin#p+,n enaJ+e J//!-!ar!I [ - ;KSAME#e!'#)!em#+/'a+#/,!p,!.'/n; ] HH mB KSAME#e!'#)!em#+/'a+#/,!p,!.'/n KSAME#e!'#)!em#+/'a+#/,!p,!.'/n.rem/BeI [ - ;KSAME#e!'#)!em#+/'a+#/,!p,!.'/n.rem/Be; ] HH KSAME#Jin#p+,n re!ar!I +eep 3 a!'* ;+ KSAME#e!'#app; e'*/
Performance
:'$ +u%%ary &d$i& !or i&cr$a'$d r$porti& $!!ici$&cy. A' you add %or$ data a&d %or$ u'$r' to +plu&, you will $&$!it !ro% +u%%ary &d$i&.
Search Help
ri&t t#$ +plu& C#$at'#$$t (D or Ma&ual) !or u'$r'. "#i' i' a r$at r$'ourc$ !or l$ar&i& t#$ '$arc# la&ua$.
Storage and Data Management
>$w &d$. t i' al%o't alway' appropriat$ to u'$ %ultipl$ i&d$$' a&d &ot $$d'. M$t#odically pla& 'tora$ &$$d' !or a &$w d$ploy%$&t, prior to i%pl$%$&tatio&. Co&'id$r %o*i& your +plu& dataa'$ (S%L&*0') to it' ow& *olu%$ to $&'ur$ cl$a& '$paratio& o! t#$ i&ary;co&!iuratio& 'tructur$ a&d t#$ data. "#i' i' &ot &$c$''ary, ut t#$r$ ar$ ad*a&ta$' i& #i#-*olu%$ $&*iro&%$&t'. Data r$t$&tio&. %pl$%$&t data r$t$&tio& a&d di' u'a$ co&trol' $plicitly a&d $arly i&'t$ad o! waiti& !or a di' to !ill. Co&!iur$ r$t$&tio& i& i&d$$'.co&! to pu'# old$r data to r$%ot$ *olu%$' 'uc# a' >+ %ou&t !or data arc#i*$. Caution8 C#a&$' to t#$ r$t$&tio& policy ( indexes.conf ) ca& $ p$rilou' a&d t#$ $!!$ct i' &ot alway' i%%$diat$. @$ 'ur$ you &ow w#at you ar$ c#a&i& a&d #a*$ trac$d c#a&$' a&d t#$ r$'ult' appropriat$ly to $&'ur$ it #a' t#$ d$'ir$d $!!$ct. D;@C. Co&!iur$ a Di'a't$r $co*$ry a&d @u'i&$'' Co&ti&uity la& !or your +plu& d$ploy%$&t. "#i' will i&clud$ i%pl$%$&ti& a acup pla&. & additio& to t#$'$ it$%', co&'id$r aci& up t#$ 1S%L&*0(H2,/etc/deployment-apps dir$ctory a&d 1S%L&*0(H2,/etc/system/local/serverclass.conf o& t#$ D$ploy%$&t +$r*$r Di'triut$d Arc#it$ctur$. Car$!ully pla& +plu& Di'triut$d Arc#it$ctur$ to $&'ur$ t#$ %o't accurat$ a&d $!!ici$&t proc$''i&. Dri*$ 'p$$d %a$' a di!!$r$&c$. +plu& #a' i&!or%ally docu%$&t$d t#at a& i&cr$a'$ i& dri*$-'p$$d will #a*$ a dra%atic i%pro*$%$&t o& p$r!or%a&c$. AD L$*$l. :'$ AD10 w#$&$*$r po''il$ !or t#$ +plu& data'tor$. Littl$ i%pact will $ '$$& at low *olu%$'? #ow$*$r, at #i#$r data *olu%$' you will '$$ p$r!or%a&c$ i%pro*$%$&t wit# AD10 o*$r AD 5. • • •
•
•
•
•
•
•
•
Deployment Server
D$ploy%$&t +$r*$r +$l$ctio& "#$ D+ ca& $ collocat$d wit# a&y ot#$r !ull +plu& i&'ta&c$? #ow$*$r, t#$r$ ar$ al'o •
+i&c$ t#$ D+ r$9uir$' 'o %a&y acti*$ "C '$''io&' (at l$a't o&$ !or $ac# co&&$ct$d cli$&t), c#oo'$ a 'y't$% t#at alr$ady #a' a li%it$d &u%$r o! op$& "C '$''io&' to ot#$r 'y't$%', 'uc# a' a +$arc# /$ad. E&'ur$ t#$ D+ '$r*$r #a' pl$&ty o! %$%ory. Co&'id$r a 'ta&d-alo&$ 'y't$% i! t#$ &u%$r o! d$ploy%$&t-cli$&t' will $c$$d 300-500 Co&'id$r o&$ D$ploy%$&t +$r*$r i&'ta&c$ !or $*$ry 2000 poll' p$r %i&ut$. Cr$at$ a D>+ #o't &a%$ 'p$ci!ic to t#$ D+ ($.. 'plu&-d'.your!oo.!9d&) a&d u'$ t#i' &a%$ !or all co%%u&icatio& !ro% t#$ d$ploy%$&t-cli$&t'. "#i' will %a$ it %uc# $a'i$r to %irat$ lat$r, i! you c#oo'$ to. Ada%$ dir$cti*$ i& t#$ d$ploy%$&tcli$&t.co&! to $a'$ w#it$li'ti& a&d lacli'ti& i& your '$r*$rcla''.co&! 7&ly d$ploy co&!iuratio& a&d par'i& app', 'uc# a' "$c#&oloy Addo&' ("A'). "#$r$ i' *$ry littl$ *alu$ i& d$ployi& da'#oard a'$d app', a&d i& 'o%$ ca'$' %ay cau'$ co%plicatio&'. r$p$&d d$ploy$d co&!iuratio& app' (&ot "A') wit# D+-. "#i' di'ti&ctio& ca& #$lp tr$%$&dou'ly w#$& troul$'#ooti& prol$%' wit# d$ploy%$&t cli$&t'. •
• • • •
•
•
•
•
App Development
•
•
E&'ur$ all (i! po''il$) '$arc#$' call 'a*$d '$arc#$' or u'$ ot#$r &owl$d$-it$%' 'uc# a' Macro' or E*$&ttyp$'. Co&tai&i& all o! t#$'$ &owl$d$-it$%' #$lp' wit# %a&a$aility o! t#$ data acro'' a& $&t$rpri'$ d$ploy%$&t. Ma&ai& ar$ '$arc#$' acro'' app' or call$d $t$r&ally *ia 'cript' do$' &ot 'cal$ w$ll a&d ca& cr$at$ a i prol$% duri& uprad$', %iratio&', a&d ot#$r %ai&t$&a&c$. W#$& cr$ati& !i$ld';$*$&ttyp$' r$!$r to t#$ +plu& Co%%o& &!or%atio& Mod$l to $&'ur$ !orward-co%patiility wit# +plu& a&d +plu&a'$ uilt-i&'. W#$& d$*$lopi& a& app, $&'ur$ t#at a&y lo or pid !il$' ar$ &ot 'tor$d i& t#$ app' dir$ctory. ! t#$ app i' di'triut$d *ia d$ploy%$&t '$r*$r, t#$ !il$' a&d dir$ctory 'tructur$ i& t#$ app will $ r$plac$d wit# t#o'$ !ro% t#$ d$ploy%$&t '$r*$r, w#ic# would i&clud$ a&y lo or pid !il$'.
Analytics
:'$ =$tWatc#Li't. =$tWatc#Li't i' a !r$$ +plu& app o& +plu&-a'$ t#at allow' u'$r' to %a&a$ looup tal$' o& t#$ 'y't$% wit#out r$9uiri& '#$ll or ad%i&i'trati*$ acc$''. "#$'$ looup' ca& $ u'$d i& *ariou' way' ut t#$ %o't popular %$t#od i' a' watc#li't'.
OS Configuration or Hardening
•
Li&u F$r&$l "u&i& &!o %pl$%$&t a c$&tral 'o!twar$ %a&a$%$&t 'y't$% ($.. M r$po, upp$t, +at$llit$ +$r*$r) to %a&a$ paca$' a&d co&!iuratio&' to !orward$r' a&d ot#$r r$lat$d 'y't$%'. Ma&ai& +plu& i&'ta&c$' o& t#$'$ r$%ot$ 'y't$%' alway' #a' prol$%' a&d l$ad' to i''u$' 'uc# a'8 J$ry old (out o! dat$) *$r'io&' o! +plu& t#rou#out t#$ $&t$rpri'$ orward$r' t#at #a*$ &ot #ad +plu& co&!iur$d prop$rly or loc$d dow& ($.. c#a&i& t#$ ad%i& pa''word a&d tur&i& o!! +plu& w$) &co&'i't$&t co&!iuratio&' l$adi& to 'i%ilar 'y't$%' '$tti& di!!$r$&t %$tadata o& t#$ 'a%$ typ$ o! lo'. Arc#it$ctur$ typ$. +plu& wor' w$ll wit# ot# 32 a&d 64 it plat!or%'? #ow$*$r, t#$r$ i' a co&'id$ral$ p$r!or%a&c$ i%pro*$%$&t !or 64 it a&d t#i' '#ould $ '$l$ct$d (ot# !or /ardwar$ a&d 7p$rati& +y't$%) w#$&$*$r po''il$. artitio&' a&d Jolu%$' :'$ LJM to %a&a$ u&d$rlyi& !il$-'y't$% 'pac$. 7&ly allocat$ 'tora$ 'pac$ to a& LJM !ro% a Jolu%$ =roup a' &$c$''ary a&d pr$'$r*$ t#$ $tra !or $%$r$&ci$' or !utur$ u'$. Ma$ $tt$r u'$ o! LJM partitio&i& y cr$ati& di'cr$t$ loical *olu%$' !or $ac# %a
•
•
•
•