topic Re: Azure Splunk Account in Security

Azure Splunk Account

jwhughes58 — Thu, 07 Jun 2018 19:07:52 GMT

I've read through Ryan Lait's blogs "Splunking Microsoft Cloud Data" and it answers everything but what permissions does the account need on the Azure side. I keep finding this error in the MS Azure Blob log

2018-05-17 20:54:25,199 +0000 log_level=ERROR, pid=11729, tid=Thread-9, file=mscs_storage_dispatcher.py, func_name=_dispatch_storage_list, code_line_no=86 | [stanza_name="kp_azure_dev_blob" account_name="kpsactoaladevtest01" container_name="sqldbtdlogs" blob_list="kpsqmmsbmetastoreuscn01"] Exception@_dispatch_tables() ,error_message=This request is not authorized to perform this operation using this permission.

Since I don't control the Azure permissions, I need to know what permissions the account needs in order for the Azure team to give the correct permissions.

Re: Azure Splunk Account

jconger — Wed, 13 Jun 2018 16:30:48 GMT

It sounds like you are using a shared access signature (SAS) for access based on your error message.

For allowed services, you will need:

Blob (based on your input)
Table (if you are using a table input)

For Allowed resource types, you will need:

Service, Container, and Object

For allowed permissions, you will need:

Read
List

Make sure the start and expire times are set accordingly and that your IP address is listed as allowed (if used).

Re: Azure Splunk Account

jwhughes58 — Fri, 15 Jun 2018 17:59:12 GMT

And as a side note the other problem was the Splunk TA lives on an internal network. Azure needs the NAT'ed IP in order to generate the correct SAS.