🛡️ Security

Search Head Cluster

A group of Splunk search heads that replicate configuration and knowledge objects among themselves so any member can serve users and the group survives a node failure. Members communicate over several management interfaces, which widens each node's attack surface relative to a standalone search head.

📚 Deep Dive

Learn Article

Why Your SIEM Is a Tier-0 Asset: What an Attacker Gets From One Search Head

A compromised search head hands over every stored credential, every detection rule and the power to erase the evidence. Why the SIEM belongs on the domain-controller patch clock, and what changes.

intermediate 6 min read

Back to Glossary