Deploy a Virtualized Splunk Server

Create your own Splunk Enterprise SIEM Lab

Why?

Splunk is a System Information and Event Management (SIEM) system used for collecting, searching, and analyzing machine-generated data from servers, network devices, and even applications. Setting up Splunk Enterprise on a Linux machine at home is an excellent way to build hands-on skills with a widely-used tool in cybersecurity and IT operations. By working with Splunk, we can learn to manage and query data effectively, which are essential skills for identifying security threats and resolving technical issues. This project will have us install Splunk Enterprise on a Rocky Linux system, a community-supported GNU/Linux Operating System alternative to Red Hat Enterprise Linux (RHEL), which is widely used in enterprise Linux environments.

How?

To virtualize a simple SIEM environment, we are going to create two seperate virtual machines. You will require a virtual hypervisor of your preference, although I am doing this on a a bare-metal hypervisor (ProxMox VE node).

Instructions:

1) Install `wget`, Rocky Linux minimal install does not have `wget` installed.

    sudo dnf install wget

   
2) Download the latest Splunk Enterprise RPM and its SHA512 hashsum. You will have to login to grab latest RPM package and its hashsum. Thankfully Splunk even generates a prepared `wget` command for the latest package.  

3) Generate SHA512 hashsum to verify file integrity by comparing it to the hashsum you downloaded.

    sha512sum [Splunk RPM Filename]

   and

    cat [Splunk RPM Filename].sha512

   
   If hashsums do not match, your file integrity is compromised!


4)  Install RPM package.

       sudo rpm -iv [Splunk RPM Filename]

        -i : Install

        -v : verbose

5) Start Splunk using the following command and accept the EULA.

    sudo /opt/splunk/bin/start

   
6) Create dashboard administrator credentials.
   
7) Add firewall rule to add the web dashboard, API socket, and to send logs from Forwarders.

    sudo firewall-cmd --add-port=8000/tcp --permanent
    sudo firewall-cmd --add-port=8089/tcp --permanent
    sudo firewall-cmd --add-port=9997/tcp --permanent

   

   Confirm added ports to firewall rules:

    sudo firewall-cmd --list-all | grep -m 1 ports

   
   Reload firewall rules

    sudo firewall-cmd --reload

 

 

8) Manually start the Splunk service to accept any terms and conditions and set any configurations for the first time.

    sudo -u splunk /opt/splunk/bin/splunk start

9) We are going to automate updating the system, and starting the Splunk server after the OS loads.

First we need to give the splunk user and group ownership of all the files within /opt/splunk

    sudo chown -R splunk:splunk /opt/splunk

Create the /etc/systemd/system/splunker.service a systemd service to have it run this script at start up. 

    vim /etc/systemd/system/splunker.service

Contents of /etc/systemd/system/splunker.service:

[Unit]
Description=Splunk systemd service
After=network.target

[Service]
Type=forking
User=splunk
Group=splunk
ExecStart=/opt/splunk/bin/splunk start
ExecStop=/opt/splunk/bin/splunk stop
Restart=on-failure
RestartSec=15s

[Install]
WantedBy=multi-user.target

Modify splunker.service  to be able to be executed once the OS is rebooted.

    sudo systemctl enable  /etc/systemd/system/splunker.service

Once your machine is restarted or you manually run the ~/scripts/start.sh BASH script, your Splunk Enterprise server will start. Once it is loaded you can access the Splunk Dashboard from a remote computer's web browser:

URL: http://SERVERIPADDRESS:8000/