topic Re: How to masking data by Role-based on Splunk Cloud? in Security

How to masking data by Role-based on Splunk Cloud?

yottanat2021 — Fri, 24 Mar 2023 03:33:18 GMT

I want to masking data by Role-based on Splunk Cloud.

Re: How to masking data by Role-based on Splunk Cloud?

gcusello — Fri, 24 Mar 2023 11:05:56 GMT

Hi @yottanat2021,

could you better describe your requirement?

are you speaking of data masking at index time or at search time?

Ciao.

Giuseppe

Re: How to masking data by Role-based on Splunk Cloud?

yottanat2021 — Thu, 30 Mar 2023 01:55:23 GMT

Hi @gcusello,

Thank your for reply.

I want to masking data at search-time on Splunk Cloud.

Example like this:

[1] Enable role-based field filtering feature
file: /opt/splunk/etc/system/local/limits.conf
#
[search]
role_based_field_filtering = true

[2] Config field filtering for user role (not support on UI, manual edit only), example role name is "staff"
file: /opt/splunk/etc/system/local/authorize.conf
#
[role_staff]
fieldFilter-host = SHA256
fieldFilter-_raw = s/output_mode=[^ ']+/output_mode=HIDDEN/g
fieldFilterLimit = sourcetype::audittrail
importRoles = user

Re: How to masking data by Role-based on Splunk Cloud?

gcusello — Thu, 30 Mar 2023 06:48:08 GMT

Hi @yottanat2021,

for my knowledge, it isn't possible to mask data at search time.

You can block the access to the row data, disabling the open in search feature in all the dashboards enabled for that role, and permit only access to some dashboards with a subset of fields.

This means that you must create different dashboards for each role!

Access to data is managed in Splunk at index level, in other words, if a role is enabled to see the events stored in an index, it can see all the data,

but, as I said, you can only block the access to the raw data and permit access to data only using a limited dashboard.

Ciao.

Giuseppe

Re: How to masking data by Role-based on Splunk Cloud?

yottanat2021 — Fri, 31 Mar 2023 06:56:25 GMT

Hi @gcusello,

Thank you for your guidance help me so much. 😀