How are you protecting your forwarders for manipulation?

[daniel333]

all,

How are you protecting your UFs from manipulation from Redteam/Hacker activities?

[starcher]

Some resources from an old conf talk here. https://github.com/MattUebel/splunk_UF_hardening

1. Do not run as root
2. Turn off rest api
3. Change admin password