Splunk Dev

Should Splunk deployment servers in DEV enviornments be able to access logs in the PROD environment and vice versa?

kgutterson
New Member

Hi,

I am wondering whether they are any security issues/concerns associated with deploying an instance a Splunk Enterprise server in a DEV environment that has access to logs stored in the PROD environment and vice versa.

Should deployment instances and the associated log sources be deployed separately in DEV and PROD environments with limited interconnectivity (there is no firewall filtering traffic from DEV to PROD).

Kim

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

I agree with what has been said previously about DEV and PROD environments being segregated, and typically by security policy, not allowed to talk to each other.

However, I have also been in environments where it isnt possible to have the same data sources or sourcetypes available in both environments. So in these use cases, a hybrid/distributed search configuration is one approach to this.

That being said, there are some concerns, mainly in regards to potential service impact of the DEV environment against PROD. With the way distributed search works, its possible that the DEV environment could steal resources from the PROD environment.

I think the best approach would be to replicate indexed data from PROD to DEV. If you are unable to replicate the data sources, you can always copy the indexed warm/cold buckets over to DEV, and this would give a valid data set to work on. It wouldnt be real time, but it would still work.

Another option would be Eventgen, and generate your own events based on your own sourcetype requirements. Customize it so it would resemble your own environment...

0 Karma

pradeepkumarg
Influencer

It's very specific to the organization, but most companies consider accessing PROD data from DEV servers as a security violation. This is applicable to any product/tool, not specific to Splunk.

0 Karma

kgutterson
New Member

Thanks I thought that was the case

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...