UBA - Upgrading Splunk Enterprise/Forwarder on UBA

Applicability

Description

Investigation

When UBA is installed, it is packaged with Splunk Enterprise as the Splunk Forwarder.

As time progresses, vulnerabilities are found, and newer Splunk Enterprise versions are available that have remediated certain vulnerabilities before we can push out a minor release to resolve the vulnerability.

To get an idea of which Splunk Enterprise you may upgrade to on the UBA nodes.  Please view the "Splunk Products Version Compatibility Matrix" - Compatibilitybetweenforwardersandindexers

For example, based on the Matrix linked above, if the Splunk Indexer (receiver of UBA data) is version 8.2.x, then you may upgrade to any versions of 8.1.x, 8.2.x, and 9.0.x.

Resolution

1. Based on "Splunk Products Version Compatibility Matrix" - Compatibilitybetweenforwardersandindexers and UBA-Splunk-Compatibility, download the compatible version of Splunk Enterprise onto all UBA nodes.
2. On the UBA management node, SSH as caspida user and run the following command:

/opt/caspida/bin/Caspida stop-all

3. On each UBA node, navigate to where Splunk Enterprise is downloaded, then as caspida user execute the below to untar on top of the existing Splunk Enterprise directory, this will replace the previous vulnerable version:

tar xzvf <New_Splunk_Enterprise_Version>.tgz -C /opt

I.E.

tar xzvf splunk-9.2.2-d76edf6f0a15-Linux-x86_64.tgz -C /opt

4. Then on each UBA node as caspida user execute the below command to accept the license:

/opt/splunk/bin/splunk version --accept-license --answer-yes --no-prompt --seed-passwd caspida123

5. After accepting the license, you will know the upgrade is complete once the last few line of the output show the following as an example:

[Peer-apps] Finished migration.
Splunk 9.2.2 (build d76edf6f0a15)

6. Once all nodes (if clustered UBA environment) have upgraded Splunk Enterprise, on the UBA management node start all services:

/opt/caspida/bin/Caspida start-all

Related Links

Matrix-Compatibilitybetweenforwardersandindexers