All Apps and Add-ons

Does Splunk App for Stream support decrypting TLS connections?

heath
Path Finder

I'm testing the Splunk App for Stream v6.1.0 with HTTP data and it seems to only support decrypting SSLv3 connections. As soon as I switch the SSLProtocol in Apache from SSLv3 to TLSv1.2 no data is captured. Chrome is throwing warnings for SSLv3 connections so I can't leave Apache set at SSLv3.

Tags (1)
0 Karma
1 Solution

mdickey_splunk
Splunk Employee
Splunk Employee

App for Stream does support TLS 1.0, 1.1 and 1.2; however, not all ciphers are supported. In particular, only ciphers using RSA based key exchanges (not ephemeral) are supported. For Apache, you can disable ephemeral ciphers using:

SSLCipherSuite ALL:!ADH:!EDH:!EXP:!NULL

View solution in original post

mdickey_splunk
Splunk Employee
Splunk Employee

App for Stream does support TLS 1.0, 1.1 and 1.2; however, not all ciphers are supported. In particular, only ciphers using RSA based key exchanges (not ephemeral) are supported. For Apache, you can disable ephemeral ciphers using:

SSLCipherSuite ALL:!ADH:!EDH:!EXP:!NULL

heath
Path Finder

Thanks. I had to update the line to include !ECDH.

SSLProtocol All -SSLv2
SSLCipherSuite ALL:!ADH:!EDH:!EXP:!NULL:!ECDH

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...