Security

Azure Splunk Account

jwhughes58
Contributor

I've read through Ryan Lait's blogs "Splunking Microsoft Cloud Data" and it answers everything but what permissions does the account need on the Azure side. I keep finding this error in the MS Azure Blob log

2018-05-17 20:54:25,199 +0000 log_level=ERROR, pid=11729, tid=Thread-9, file=mscs_storage_dispatcher.py, func_name=_dispatch_storage_list, code_line_no=86 | [stanza_name="kp_azure_dev_blob" account_name="kpsactoaladevtest01" container_name="sqldbtdlogs" blob_list="kpsqmmsbmetastoreuscn01"] Exception@_dispatch_tables() ,error_message=This request is not authorized to perform this operation using this permission.

Since I don't control the Azure permissions, I need to know what permissions the account needs in order for the Azure team to give the correct permissions.

0 Karma
1 Solution

jconger
Splunk Employee
Splunk Employee

It sounds like you are using a shared access signature (SAS) for access based on your error message.

For allowed services, you will need:

  • Blob (based on your input)
  • Table (if you are using a table input)

For Allowed resource types, you will need:

  • Service, Container, and Object

For allowed permissions, you will need:

  • Read
  • List

Make sure the start and expire times are set accordingly and that your IP address is listed as allowed (if used).

alt text

View solution in original post

0 Karma

jconger
Splunk Employee
Splunk Employee

It sounds like you are using a shared access signature (SAS) for access based on your error message.

For allowed services, you will need:

  • Blob (based on your input)
  • Table (if you are using a table input)

For Allowed resource types, you will need:

  • Service, Container, and Object

For allowed permissions, you will need:

  • Read
  • List

Make sure the start and expire times are set accordingly and that your IP address is listed as allowed (if used).

alt text

0 Karma

jwhughes58
Contributor

And as a side note the other problem was the Splunk TA lives on an internal network. Azure needs the NAT'ed IP in order to generate the correct SAS.

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...