Reporting

Restrict Export of Sensitive Data

Motivator

Hi, I wonder whether someone could help me please.

The Splunk environment I administer contains sensitive personal data which only those with the relevant clearance can view.

To add an extra line of security, my security team have asked me to remove the 'export' function so these personal details can't be downloaded, that is, until the relevant clearance is provided.

I can make the changes via the 'authorize.conf' file to the user role, setting the 'export_is_visible' in the 'Parent' role to disabled and then a 'child' role which enables the capability.

The problem I have is:

  • I want to restrict this via app, rather than a 'global ' restriction, because in addition to apps with dashboards containing sensitive data, they have access to apps with dashboards which have pure statistical data.
  • In addition, I can't change the role associated with the app, because if I change this, everyone who can just view the statistical dashboards and hence can download the data will also be affected.

Could someone tell me please is there another way to achieve this?

Many thanks and kind regards

Chris

0 Karma
1 Solution

Splunk Employee
Splunk Employee

@IRHM73, apps are deployed to machines, not to people. I don't think you'll be able to do what you're trying to do unless you want to give access to a specific machine once clearance is given.

Global Roles are the best way to achieve this.

View solution in original post

Splunk Employee
Splunk Employee

@IRHM73, apps are deployed to machines, not to people. I don't think you'll be able to do what you're trying to do unless you want to give access to a specific machine once clearance is given.

Global Roles are the best way to achieve this.

View solution in original post

Motivator

Hi @brreeves, thank you for the confirmation.

Regards

Chris

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!