topic Re: searching in splunk indexes in Splunk Search

searching in splunk indexes

user487596 — Thu, 29 Aug 2024 08:38:50 GMT

Hello everyone! How can we solve the problem of searching for secrets in all or some splunk indexes so that splunk is not heavily loaded: how can this be implemented? (approach).

It is obvious that the list of indexes needs to be limited. What else?

Re: searching in splunk indexes

gcusello — Thu, 29 Aug 2024 09:34:51 GMT

Hi @user487596 ,

could you better describe your requisite?

In Splunk access to data is managed at index level, in other words, you can define for each role, which are the indexes that the users with that role can access.

In addition, it's also possible to add some additional restrictions, but always at Role level, not user level.

Ciao.

Giuseppe

Re: searching in splunk indexes

user487596 — Thu, 29 Aug 2024 09:40:07 GMT

HI, @gcusello
I need to find secrets (passwords, api-tokens, etc.) in all data (events) in all indexes that are in splunk, the question is in the approach: how to do this so as not to overload splunk.

Re: searching in splunk indexes

gcusello — Thu, 29 Aug 2024 09:46:29 GMT

Hi @user487596 ,

Splunk is a search engine, so you can use it for this:

you must know the rules (e.g. searching for the password word) and then apply to the indexes.

At first I'd start identifying the login and create user actions for each environment in your infrastructure (e.g. in windows these action are identifed with EventCode = 4624 and 4720), then you can run searches with those specific filters to see if there are clear text passwords.

Ciao.

Giuseppe

Re: searching in splunk indexes

user487596 — Mon, 02 Sep 2024 12:54:02 GMT

@gcusello , It's pretty clear what to look for, the question is how to do it in all indexes without loading splunk

Re: searching in splunk indexes

gcusello — Mon, 02 Sep 2024 13:06:27 GMT

Hi @user487596 ,

sorry but I don't understand: what do you mean with "in all indexes without loading splunk"?

You could use APIs to access Splunk from your application without using the Splunk GUI.

Ciao.

Giuseppe