topic Re: Need help locking down SH app in Splunk Enterprise

Need help locking down SH app

fnetechnology — Mon, 17 May 2021 22:12:39 GMT

Hello, need a quick help... I am working on locking down one of my Splunk applications. I do not want any user/power user roles able to make any changes in the UI to any Knowledge Objects... I would rather have the code checked in SVN (Subversion) and not directly on the UI... Any suggestions would be great! Thank you.

Re: Need help locking down SH app

venkatasri — Mon, 17 May 2021 23:38:15 GMT

Hi @fnetechnology

default.meta is the right file to control Access to Knowledge Objects, Follow below link and set read-only permissions to Object_types (aka Knowledge Object) that your app contains.

Set permissions using RBAC | Documentation | Splunk Developer Program

-----------------------------------------------------

An upvote would be appreciated if it helps!

Re: Need help locking down SH app

fnetechnology — Tue, 18 May 2021 12:51:08 GMT

Thank you!

Re: Need help locking down SH app

isoutamo — Mon, 24 May 2021 09:59:28 GMT

Please remember that this mach only those versions which are shared as app or globally. If those persons have own version (clones) they can use those as earlier.