Getting Data In

Best practices for Splunking mobile endpoints

responsys_cm
Builder

I'd just like to hear from anyone who has implemented a successful strategy for Splunking mobile endpoints (Windows, OSX, Linux...).

It would seem to me that since accelerated data models run every five minutes by default, capturing events from mobile endpoints would need to happen in <5 min window. So, having a Universal Forwarder that can only forward data when on a VPN, or physically connected to the corporate network seems like a losing strategy.

This would mean having some kind of intermediate forwarder and deployment server available to the Internet.

Has anyone tried this?

What kind of security controls and tools did you use to protect the Internet-facing Splunk infrastructure?

Thanks.

C

Labels (1)

TheSplunkDude
Explorer

Good question. I would be interested how this is done for off network systems.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...