Splunk® Enterprise

Securing the Splunk Platform

Acrobat logo Download manual as PDF

Splunk Enterprise version 7.2 will no longer be supported as of April 30, 2021. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
Acrobat logo Download topic as PDF

Harden your Windows installation

If you choose a directory that is outside of the Windows Program Files application directory on the drive that booted your Windows machine, that directory does not get the automatic protections that directories inside the Program Files directory get.

Follow these instructions to ensure that Windows enforces the proper access controls to the Splunk software installation directory and that low-privilege users cannot access that folder.

Harden Splunk software installation directories with Windows Explorer

  1. From an Explorer window, right click on the target installation folder and select Security > Advanced > Disable Inheritance > Remove all inherited permissions from this object.
  2. Click Add > Select a principal > Administrator > Check Names.
  3. Click OK.
  4. Click Check full control.
  5. Click OK.
  6. Click Add > Select a principal > SYSTEM > Check Names.
  7. Click OK.
  8. Click Check full control.
  9. Click OK.
  10. Click Apply. then click OK

Harden Splunk software installation directories from a PowerShell window or command prompt

These instructions were tested and work as described on Windows versions 8.1 and higher, and Window Server versions 2008 R2 and 2012 R2. As an example, this procedure uses C:\Splunk as the installation directory.

  1. Open a command prompt or PowerShell window.
  2. Run the following command to break inheritance from parent directories.
    C:\>icacls C:\Splunk /inheritance:d
  3. Run the following command to remove the Users group from the directory.
    C:\>icacls C:\Splunk /remove "Users" /T
  4. Run the following command to remove the "Authenticated Users" group from the directory.
    C:\>icacls C:\Splunk /remove "Authenticated Users" /T
Last modified on 09 December, 2020
About default certificate authentication
Secure Splunk Enterprise on your network

This documentation applies to the following versions of Splunk® Enterprise: 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.0.10, 8.1.0, 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.1.5, 8.1.6, 8.1.7, 8.1.8, 8.2.0, 8.2.1, 8.2.2, 8.2.3, 8.2.4

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters