topic Re: Access permissions in cisco firewall app in Security

Access permissions in cisco firewall app

jaygirlardo — Fri, 02 Nov 2012 14:43:21 GMT

Hey Splunkers,

I got a question hopefully someone can answer. In my setup I have the cisco security suite and cisco firewalls app installed, as well as the windows app. I am having problems with cisco firewall data showing up in a users overview. The user only has permissions to it's site's index that contains that sites domain controller. The user has inherited roles from the default user but in that role I have deleted having access to main and internal indexes. So the default user has access to no indexes. Then when I created the sites user I gave him access to only the one index. So why is firewall info from other indexes showing up in his firewall app overview?

Any help is appreciated, Thanks!

Re: Access permissions in cisco firewall app

DaveSavage — Fri, 02 Nov 2012 15:18:36 GMT

Jaygirlardo,
These plug-ins use the index=firewall...and I guess that is the one you gave them access to?
If a user ran a standard search...and hypothetically a firewall pushed its logs to, say, a syslog server...which has a forwarder on it...then the results may go elsewhere e.g. 'main' which is the default?
How, or at what level did you think you implemented the permission(s)?
User level within Splunk are fairly generic (from Manager tab...but you prob already know that).
Have you implemented any specific transforms?
Br
Dave

Re: Access permissions in cisco firewall app

DaveSavage — Fri, 02 Nov 2012 15:28:37 GMT

Indexes searched by default has to be 'clear all'd...I take it you did that?

Re: Access permissions in cisco firewall app

jaygirlardo — Fri, 02 Nov 2012 15:32:13 GMT

Re: Access permissions in cisco firewall app

jaygirlardo — Fri, 02 Nov 2012 15:34:05 GMT

Yes the firewall logs are going to a different index that they do not have permission to. I configred it right for the windows app because they only see windows info from their index, not any other window machines. But somehow firewall info is viewable from their login. for some reason I dont think it has to do with permissions. Maybe something the cisco firewall app does by default? I think I have a good idea how the roles and users work, but I could be wrong.

Re: Access permissions in cisco firewall app

DaveSavage — Fri, 02 Nov 2012 15:39:39 GMT

In Manager??Access controls >> Users...does your user (listed there) have 2 roles in the near right column...e.g. 1 you created / crafted specially AND a default one?
If so, click on them and remove the default grey selected role....

Re: Access permissions in cisco firewall app

DaveSavage — Fri, 02 Nov 2012 15:53:34 GMT

...and if it's not that (an over-sight I've made in the past ;-)...then you may need the orig author's 2-penneth.
I did clock in the release notes that (for say ASAs which we use) the update as at Sept 10th indicates 'is now index independent')....hmm.

Re: Access permissions in cisco firewall app

jaygirlardo — Fri, 02 Nov 2012 16:03:55 GMT

Yup, they only have the one role I assigned them. About index independent, what is?