Splunk® Enterprise

Securing Splunk Enterprise

Download manual as PDF

Download topic as PDF

Harden your Windows installation

If you choose a directory that is outside of the Program Files directory on the drive that booted your Windows machine, that directory does not get the automatic protections that directories inside Program Files get.

Follow these instructions to ensure that Windows enforces the proper access controls to the Splunk software installation directory and that low-privilege users cannot access that folder.

Harden Splunk software installation directories with Windows Explorer

  1. From an Explorer window, right click on the target installation folder and select Security > Advanced > Disable Inheritance > Remove all inherited permissions from this object.
  2. Click Add > Select a principle > Administrator > Check Names.
  3. Click OK.
  4. Click Check full control.
  5. Click OK.
  6. Click Add > Select a principle > SYSTEM > Check Names.
  7. Click OK.
  8. Click Check full control.
  9. Click OK.
  10. Click Apply. then click OK

Harden Splunk software installation directories from a PowerShell window or command prompt

These instructions were tested and work as described on Windows versions 8.1 and higher, and Window Server versions 2008 R2 and 2012 R2. As an example, this procedure uses C:\Splunk as the installation directory.

  1. Open a command prompt or PowerShell window.
  2. Run the following command to break inheritance from parent directories.
    C:\>icacls C:\Splunk /inheritance:d
    
  3. Run the following command to remove the Users group from the directory.
    C:\>icacls C:\Splunk /remove "Users" /T
    
  4. Run the following command to remove the "Authenticated Users" group from the directory.
    C:\>icacls C:\Splunk /remove "Authenticated Users" /T
    
PREVIOUS
About default certificate authentication
  NEXT
Secure Splunk Enterprise on your network

This documentation applies to the following versions of Splunk® Enterprise: 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.3.0, 7.3.1


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters