Splunk Security Essentials: Segregation/Multi-tenancy: How would you approach adding multi-tenancy to SSE?

[joostdecock]

TL;DR: How would you approach adding multi-tenancy to SSE?

Hi there,

I am looking to use the Splunk Security Essentials (SSE) app on a search head (SH) that is peered with a bunch of other SHs that have their own data.

The app works fine, but it throws all the data it can find onto one pile and does its thing.

What I'd like is to be able to set a SSE-wide extra query constraint (splunk_server=whatever) so that it would only look at data from that peered SH.
This applies both to the original introspection, as well as the subsequent reports, and mapping to the MITRE framework.

Best case scenario, I can add a drop-down to select the peer and now the app would work with data from that peer.
Alternatively, I guess I could deploy a modified app for each peer that is then configured to look at that data only.

I'm relatively new to Splunk ( hi :wave: ) but not so new to development, so I'm happy to roll up my sleeves.

I was hoping that perhaps somebody with a good understanding of the app (there's a lot going on) could give me some pointers on the best way to tackle this.


thanks in advance for your input, much appreciated  : )
joost

[richgalloway]

I treat SSE as a cookbook.  I use it to get example SPL and then build my own searches from it.  When you build your own SPL, include code to isolate searches to the desired tenant.

[joostdecock]

Thank you @richgalloway for your input.

That is certainly good advice, and indeed always an option.
I'd like to integrate it into that app though, so operators can use it that way.

So I'm hoping somebody with more insight into that app itself has some pointers : )