Splunk Enterprise Pt. 1

In todays blog post I’m going to go over one of the many SIEM tools widely used today in many enterprises (both in the commercial sector as well as the DOD), Splunk.

Splunk is best known for monitoring, searching through, analyzing, and providing visuals for real time data. In laymens terms, we can generate pretty, meaningful graphs and charts, from data that is otherwise just lines of log files or computer-generated data (and get notifications from, etc).

So to start, I am going to install Splunk on its own dedicated RHEL 8 virtual machine:

ESXI Setup Screen

Now why I choose RHEL 8 instead of Ubuntu or Debian? Quite honestly I wanted to stick to as close to DOD used Operating Systems for my current role (which, if you are currently working in your Cybersecurity/IT role, your homelab should closely mimic technologies you are working with/exposed to as well!). I also have a RHEL Developer License that has several RHEL keys I’ve been meaning to use up.

Splunk has a Reference Hardware page that outlines “recommended” hardware they have tested for various environments, however for a HOMELAB, realistically we aren’t going to be able to spare this many cores (yet… One day I will get to this point), so for now I’m going to give this VM 4 cores and 12GB of ram. Also I will add that in a normal “Enterprise” environment, you would have a Search Head or two, a few Indexers, along with your forwarders, however in this environment I will have everything combined into one machine as I do not have a massive environment to collect log files from (yet). Also I’ve already signed up for a Splunk Developer License which gave me 6 months to test (with the option to renew within 10 days of the license expiring) plus bumps my log aggregation from 500MB to 10GB)

ESXI VM Creation Screen

Then I’ll start the VM up and install RHEL as required, and install my RHEL License:

Normally I would select “Server without GUI”, however, I plan on accessing Splunk only on my RHEL Machine after I install it (remoting in from ESXi), so I am installing a GUI to have access to it.