To create a test Splunk VM connecting to log exported from Openshift

BCDevOps / developer-experience

This repository is used to track all work for the BCGov Platform Services Team (This includes work for: 1. Platform Experience, 2. Developer Experience 3. Platform Operations/OCP 3)

Apache License 2.0

8 stars 17 forks source link

To create a test Splunk VM connecting to log exported from Openshift #2197

Open bruce-wh-li opened 2 years ago

bruce-wh-li commented 2 years ago

Describe the issue Need a test Splunk instance with non restricted Admin user created for Nick and Bruce

Additional Mirror what is used in production Splunk with less sensitive data

Definition of done

[ ] Splunk is installed in a new Testing VM (SecOps)
[ ] Admin User ID created for Nick and Bruce
[ ] URL of new Test Splunk provided
[ ] Forward Openshift Log to test Splunk
[ ] Complete Splunk setup such that splunk can search openshift log data

StevenBarre commented 2 years ago

Suggest breaking this up into a few separate tickets, assigned to different people

iStore order a Linux VM in the DMZ - The Linux team can set this up for you - Luke can own this ticket
Install Splunk yourself in your IDIR account, or get the Application and Managed Services team to install it for you via Professional Services
Forward Openshift Log to test Splunk - this part can be completed by the MCS team
Complete Splunk setup such that splunk can search openshift log data - ticket for your team

bruce-wh-li commented 2 years ago

Austin has provided a new url URL: https://siem.secops.gov.bc.ca/cloud. But this is not testing VM but prod VM for CPF team