topic Re: Minimum permissions to facilitate log ingestion in Getting Data In

Minimum permissions to facilitate log ingestion

MohammedKhanIUK — Thu, 26 Sep 2024 12:25:50 GMT

Hi all,

I was wanting to get an understanding on what the minimum permissions available to enable the log flow between GitHub and Splunk cloud, as going by the documentation for the app, the account used to pull in the logs requires :
admin:enterprise Full control of enterprises
manage_billing:enterprise Read and write enterprise billing data
read:enterprise Read enterprise profile data

Can we reduce the amount of high privileged permissions required for the integration ?

Re: Minimum permissions to facilitate log ingestion

sainag_splunk — Thu, 26 Sep 2024 16:42:51 GMT

I know for configuring all the audit events related to Github Enterprise and Github Organization from GitHub Cloud via modinputwith Account Type = Organization.
the Personal Access Token also needs the granted access - "admin:org".

Re: Minimum permissions to facilitate log ingestion

MohammedKhanIUK — Thu, 26 Sep 2024 21:11:31 GMT

Can the permissions be limited to specific capabilities aside from admin:org for audit events? Or is that a fundamental requirement to pull in audit logs?

Re: Minimum permissions to facilitate log ingestion

sainag_splunk — Thu, 26 Sep 2024 22:31:13 GMT

@MohammedKhanIUK I believe that's the requirement.

NOTE: To collect the audit-logs, the user should have admin access of the organization/enterprise and read:audit_log scope for the Personal Access Token.

https://docs.splunk.com/Documentation/AddOns/released/Github/Configureinputs

If this reply helps you an upvote and "Accept as Solution" is appreciated.