Can the Microsoft OMS Moduar Inputs TA be configured to store credentials in the Splunk Credential Store?

[port7]

Setting up the OMS Inputs TA and it looks like the API Key for OMS are stored in plaintext in inputs.conf

Is there anyway for this to be stored more securely such as in the Splunk Credential store??

[jkat54 · Accepted solution]

Key encryption is coming soon but it’s not available in the app’s current version.

UPDATE: Key encrypt is supported in the latest version of the app, and uses the splunk encryption framework provided by the splunk add-on builder.

[MattShep]

Hi @jkat54,

How are the details encrypted in the new update? The release notes just state they are but no further information. We haven't yet upgraded to the newer version as we need to confirm this first.

thanks for the assistance.

[jkat54]

Hey @MattShep,

The encryption was achieved using the add on builder and its out of the box field encryption capabilities.

Therefore the keys are encrypted using the splunk.secret as a salt like all the other password fields in splunk core.

[port7]

Thanks @jkat54, any predictions on when this will be available?

[jkat54]

It’s available as of today. See version 1.3.3.

[p_gurav]

You can tag @jkat54 for support.