Splunk Profile

Splunk Enterprise SIEM with dual AD domains and workstations. Fase 1 — core infrastructure and agent enrollment.

Validated on Ludus 2 across all three profiles (--base, --dual, --adcs): a from-scratch deploy (destroy + deploy) succeeds, domain authentication works, Splunk is reachable, and every Universal Forwarder reports telemetry.

---

Table of contents

1. Infrastructure
2. Network Diagram
3. Credentials
   1. Local & Domain — Ludus defaults
4. Deployment
5. Verify
6. Developer License
7. Notes

---

Infrastructure

All VMs run on VLAN 20.

IP	Hostname	OS	Role
.20.1	splunk	Ubuntu 24.04	SIEM — Splunk Enterprise
.20.11	DC01-2022	Windows Server 2022	Primary DC — thruntops.domain
.20.12	DC01-SEC	Windows Server 2022	Primary DC — secondary.thruntops.domain
.20.21	WIN11-22H2-1	Windows 11 22H2	Workstation — thruntops.domain
.20.22	WIN11-22H2-2	Windows 11 22H2	Workstation — secondary.thruntops.domain

IP prefix depends on the Ludus range network (e.g. 10.1.0.0/16 → 10.1.20.x).

Table shows --dual (5 VMs). --base drops the secondary domain (3 VMs: splunk, DC01-2022, WIN11-22H2-1). --adcs swaps the secondary domain for a dedicated ADCS VM at .20.13 (4 VMs: splunk, DC01-2022, ADCS, WIN11-22H2-1) — single domain only.

---

Network Diagram

graph TB
    subgraph VLAN20["VLAN 20"]

        subgraph primary["thruntops.domain"]
            DC1["🖥 DC01-2022\n.20.11\nPrimary DC"]
            W1["🖥 WIN11-22H2-1\n.20.21\nWorkstation"]
        end

        subgraph secondary["secondary.thruntops.domain"]
            DC2["🖥 DC01-SEC\n.20.12\nPrimary DC"]
            W2["🖥 WIN11-22H2-2\n.20.22\nWorkstation"]
        end

        SPLUNK["🐧 splunk\n.20.1\nSplunk Enterprise"]
    end

    DC1 <-->|"domain trust"| DC2
    W1 -->|"member"| DC1
    W2 -->|"member"| DC2

    SPLUNK -.->|"UF :9997"| DC1
    SPLUNK -.->|"UF :9997"| DC2
    SPLUNK -.->|"UF :9997"| W1
    SPLUNK -.->|"UF :9997"| W2

---

Credentials

Service	URL	User	Password
Splunk Web	http://<range_ip>.20.1:8000	admin	set in splunk-dual.yml → ludus_splunk_admin_password

Local & Domain — Ludus defaults

User	Password	Scope
localuser	password (template default)	Local Admin (Windows) / SSH login (Linux) — all VMs
THRUNTOPS\domainadmin	password	Domain Admin — thruntops.domain
THRUNTOPS\domainuser	password	Domain User — thruntops.domain
SECONDARY\domainadmin	password	Domain Admin — secondary.thruntops.domain
SECONDARY\domainuser	password	Domain User — secondary.thruntops.domain

---

Deployment

bash splunk.sh --dual   # 2 AD + 2 workstations
bash splunk.sh --base   # 1 AD + 1 workstation
bash splunk.sh --adcs   # 1 AD + ADCS + 1 workstation

Or step by step:

ludus range destroy
ludus range config set -f ranges/splunk-dual.yml
ludus range deploy
ludus range logs -f

---

Verify

All three profiles have passed the post-deploy validation checklist on Ludus 2, run with the matching flag:

RANGE_PREFIX=10.<range> tests/splunk_checklist.sh --base   # or --dual / --adcs

Or manually, confirm the Universal Forwarders are connected:

Splunk Web → Settings → Forwarding and receiving → Forwarder management

Every Windows VM in the deployed profile should appear (2 for --base, 4 for --dual, 3 for --adcs).

Check range status:

ludus range status

---

Developer License

By default Splunk runs under the free license (500 MB/day ingest limit). To apply a developer license (50 GB/day):

1. Download your license from dev.splunk.com
2. Place the file at the repo root as Splunk.License (already in .gitignore)
3. Copy it to the Ludus server:

   scp Splunk.License ludus-admin@<ludus-host>:~/
   

4. Set ludus_splunk_license_src in splunk-dual.yml (or the profile you’re using):

   ludus_splunk_license_src: "/home/ludus-admin/Splunk.License"
   

---

Notes

• splunk-dual.yml deploys Splunk Enterprise version 10.2.1 (also available as splunk-base.yml and splunk-adcs.yml — see splunk.sh)
• Known issue (ThruntOps-m13): the Splunk Universal Forwarder fails to read the Microsoft-Windows-Sysmon/Operational event channel on domain-member Windows machines (workstations and the ADCS VM) with ACCESS_DENIED — confirmed across all three profiles during validation. Domain controllers are unaffected. Only Sysmon telemetry is impacted; the rest of the Windows/Security event log forwarding works normally. Root cause not yet fixed.
• Fase 2 will add ADCS, MSSQL, and OPS VM.