All Apps and Add-ons

Splunk DB Connect 3 - how to grant a role only to perform predefined dbxlookup, nothing else

sylbaea
Communicator

I have DB Connect 3.1 installed on my SHC.
I created a DB lookup to provide additional info about host.

I would like to know if it is possible to create a custom role that would grant (and only that) the right to execute
search XXX | dbxlookup mylookup

Especially I want to avoid my users to leverage this access to perform "free" SQL queries against the SQL DB targeted by the lookup... I a afraid what I ask is not possible as it looks permissions can only be granted at identity / connection level.

Also I notice dbxlookup now has an option to create lookup on the fly:

 dbxlookup connection=<connection name> query=<SQL query>

This is typically what I would like to avoid my users to be able to do.

Is it possible ?
Note: using dbxquery + outputlookup to periodically update a standard lookup (as suggested by documentation) is something interesting still I would like to perform live query in this specific use case.

Regards.

0 Karma

woodcock
Esteemed Legend

If you need a "Formal Answer" then post your need for a clarification in the "Post a Comment" section of the documentation page here:

http://docs.splunk.com/Documentation/DBX/latest/DeployDBX/Createandmanagedatabaselookups

0 Karma

somesoni2
Revered Legend

Try creating a new role with just this capability (and derived from 'user' role).

db_connect_read_dblookup

sylbaea
Communicator

Indeed I was planning to try what you suggest but as my concern is about data privacy/security, I am looking for a formal answer... I might miss a corner case if I just do a test by myself. I need to be 100% sure there will be no way to anything else that what is exposed by the lookup.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...