Restrict Export of Sensitive Data

[IRHM73]

Hi, I wonder whether someone could help me please.

The Splunk environment I administer contains sensitive personal data which only those with the relevant clearance can view.

To add an extra line of security, my security team have asked me to remove the 'export' function so these personal details can't be downloaded, that is, until the relevant clearance is provided.

I can make the changes via the 'authorize.conf' file to the user role, setting the 'export_is_visible' in the 'Parent' role to disabled and then a 'child' role which enables the capability.

The problem I have is:

• I want to restrict this via app, rather than a 'global ' restriction, because in addition to apps with dashboards containing sensitive data, they have access to apps with dashboards which have pure statistical data.
• In addition, I can't change the role associated with the app, because if I change this, everyone who can just view the statistical dashboards and hence can download the data will also be affected.

Could someone tell me please is there another way to achieve this?

Many thanks and kind regards

Chris

[brreeves_splunk · Accepted solution]

@IRHM73, apps are deployed to machines, not to people. I don't think you'll be able to do what you're trying to do unless you want to give access to a specific machine once clearance is given.

Global Roles are the best way to achieve this.

[IRHM73]

Hi @brreeves, thank you for the confirmation.

Regards

Chris