I subscribe to a RSS feed for Splunk CVEs and diligently keep my security team in the look regarding Splunk vulnerabilities. Since I've taken over the Splunk administrator role at my company, I've upgraded everything Splunk except some 6.4 UFs. The documentation states:
Before you upgrade, consider whether you really need to. In most cases, you do not have to upgrade a forwarder. Forwarders are always compatible with later versions of indexers, so you do not need to upgrade them just because you have upgraded the indexers that they send data to.
My questions is:
Should I upgrade my UFs? Have there been significant threats since 6.4 that do affect forwarders? If not, is there a blurb (honestly, I'll accept a Splunk Answers blurb) or link out there that I can send my security team to keep them happy?
↧