Can I get an overview of how Splunk permissions work?

[jmulcaster_splu]

I want to set up an organized system of permissions so we can give the right access to the right data and the right Splunk features to the right analysts in my organization. Can I get a sketch of how permissions work in Splunk and where I can get info about how to set them up?

[jmulcaster_splu · Accepted solution]

The Splunk Product Best Practices team provided this response. Read more about How Crowdsourcing is Shaping the Future of Splunk Best Practices.

Splunk enables you to control access to your data, product features, knowledge objects, and apps by masking the content to the user.

Note: This answer applies to Splunk Enterprise and Splunk Cloud.

How access control and permissions helps protect your data

Role-based access control provides flexible and effective tools that you can use to protect Splunk data. For example, you can set search limitations, provide access to product features, data, and knowledge objects, and set the default app users land in when they log into Splunk.

You can leverage Splunk’s default roles to create additional, business-specific roles. If you establish role-based access early, you can prevent unintentional exposure to sensitive data when you create users with different roles.

Roles determine access and permissions, and have a specific set of capabilities that specify or limit the actions available to them. Read about configuring role-based user access to learn more about Splunk’s predefined roles and how to create custom roles.

Consider setting up Single Sign-on (SSO). SSO lets you use a reverse proxy to handle Splunk authentication to allow your users to seamlessly access Splunk Web and any other applications you have configured for SSO. No need to create users, Splunk will use the ones you've already defined.

• Roles: A collection of permissions and capabilities that defines a user function in Splunk Enterprise. Splunk Enterprise users can have one or more roles.
• Permissions: The level of access assigned to a role that specifies how a user with that role can interact with knowledge objects in Splunk software.
• Capabilities: A user action within Splunk Enterprise. You can use role-based security to restrict user actions in the software.

How to get started with Splunk access control

• Define a knowledge manager role. This person can create guidelines to manage knowledge objects, normalize event data, and create data models for Pivot users.
• Review your company's requirements. Identify who needs access to which data sets, if there are any that should be private, such as data with PII, and so on. Splunk Cloud users can Manage Splunk Cloud users and roles, and Splunk Enterprise users can Add and edit roles with Splunk Enterprise based upon requirements.
• Implement SAML. Splunk Cloud users can Configure SAML single sign-on to Splunk Cloud, using information provided by your supported identity provider (IdP). Splunk Enterprise users can Configure Splunk software to use SAML authentication for single sign-on (SSO), using information provided by your supported identity provider (IdP).
• Map LDAP groups to Splunk roles. Splunk Enterprise users can work with the repository administrator to set up user authentication with LDAP and configure Single Sign-On with reverse proxy.
• Learn more about Splunk roles and permissions best practices. If you'd like to explore more ideas about Splunk roles and managing permissions to data, features, and knowledge objects, see these topics in the Splunk Success Framework Handbook: Roles best practices for a Splunk deployment, User enablement best practices for a Splunk deployment, and Role-based data management best practices for a Splunk deployment.