Splunk Alerts for Microsoft Teams

[joeprest]

Our issue with this app is that we would need to give list_storage_passwords  level access to everyone in the Splunk group for alerting to teams. 

In TEAMS, since an alert_action runs as the user, AND the Teams App handles creds PROPERLY, list_storage_passwords is required.

https://dev.splunk.com/enterprise/docs/developapps/manageknowledge/secretstorage/secretstoragerbac/…

it's not the USER'S password but the password used to auth to Teams, so the alert action needs the Teams creds.

bottom line is we dont like an entire team having this level of access. any options we are missing?

[livehybrid]

Hi @joeprest 

I would recommend having a "service user" which owns these alerts and has the relevant permissions - therefore you do not need to give permissions to individual users.

Create a local Splunk user (I like to prefix with svc_ - for example svc_<project>_alerts) and give this specific user the required capabilities. Then change the owner of the alerts to this user.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[PickleRick]

You're missing a rules development and deployment process. Normally in a relatively mature environment rules would be developed in a dev environment and then later deployed to prod (often using a code repository) to run as a splunk system user (or another designated user).