Secure Splunk Enterprise on your network

Under certain conditions, Splunk Enterprise ports can become susceptible to attacks. Prevent access by shielding your Splunk Enterprise configuration from the Internet.

If possible, use a host-based firewall to restrict access to Splunkweb, management, and data ports. Keep Splunk Enterprise within a host-based firewall. Have your remote users access Splunk Enterprise on a Virtual Private Network.

You also can protect Splunk Enterprise from attacks in the following ways:

• Restrict CLI security by restricting this port to local calls only, from behind a host firewall.
• Unless necessary, do not allow access to forwarders on any port.
• Install Splunk Enterprise on an isolated network segment that only trustworthy machines can access.
• Limit port accessibility to only necessary connections. The necessary connections are:
  • End users and administrators must access Splunkweb (TCP port 8000 by default).
  • Search heads must access search peers on the management port (TCP port 8089 by default).
  • Deployment clients must access the deployment server on the management port (TCP port 8089 by default).
  • Forwarders must access the index server data port (TCP port 9997 by default).
  • Remote CLI calls use the management port.
• Restrict access to the KV store port on the search head. (The KV store port, by default, is 8191, and by default that port is open to the network.) On each search head cluster member, allow access to the KV store port only for the other members, so that the cluster can replicate KV store data.