All Apps and Add-ons

Why does the AMP for endpoints API require the "write" access?

hrithiktej
Communicator

Why does the AMP for endpoints API require the "write" access? I am afraid of the APP making changes to the events in AMP console. Will it delete or resolve the alerts if i give the WRITE access to the APP?

0 Karma
1 Solution

powerst
Engager

I had the same question and reached out to the app developer through my Cisco SE.

When you configure an input in the app, it needs to do a POST to the AMP API to configure the AMQPS event stream.

Once you've configured your inputs and they're all posted to your AMP instance, you can switch the app to a read-only credential and it continues to work.

Tested this myself and it so far it's been working as described. If I need to modify an input I temporarily swap in a RW API credential and go back to RO after the modification is made.

View solution in original post

powerst
Engager

I had the same question and reached out to the app developer through my Cisco SE.

When you configure an input in the app, it needs to do a POST to the AMP API to configure the AMQPS event stream.

Once you've configured your inputs and they're all posted to your AMP instance, you can switch the app to a read-only credential and it continues to work.

Tested this myself and it so far it's been working as described. If I need to modify an input I temporarily swap in a RW API credential and go back to RO after the modification is made.

powerst
Engager

Small update to this.

Do not delete the RW API credential set from the AMP console. If you do, it will delete any event streams created using that credential set.

Also, input in the app will continue to use RW credentials even after you change configuration to different RO credential. You'll need to edit local/inputs and update the api_id and api_key for your created input manually if you want to be sure those keys aren't stored anywhere.

0 Karma

hrithiktej
Communicator

cool thanks for the update

0 Karma

linuxnoobcast
New Member

Can we have another app with read only rights? ,Can we have a repose on this? from the developer? it would be better if we have another app that requires read only rights.

0 Karma

hrithiktej
Communicator

I was unable to get it to work with read only access and then i explained my AMP admin and they got me both access and from last 4 months we are pulling data into Splunk and can say that it is safe to have read and write both. But i agree ideally it should work with read only access.

I have not tested whether it requires read write initially or whether throughout

0 Karma

tomasmoser
Contributor

I have the same "issue". My CSIRT team that is in charge of AMP deployment will give me only RO-only access. Can we go about it somehow? Perhaps R/W user is only necessary for initial set-up and we can change it to RO for future use? This is really a limitation 😞

Tomas

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...