Captain Picard's Star fleet messages

[MuS]

Hi Splunk- and other Gurus

Assumption:

Captain Picard's room is a high security Environment, so him and only himself is allowed to read all the high classified Star fleet messages. if Captain Picard is called to the Bridge, he also can read his private messages but not the high classified messages although he is identified as Captain Picard.

Is there a way to filter/handle this in Splunk for example by search origin or by user role?

cheers, MuS

[hazekamp · Accepted solution]

Mus,

If I understand correctly you are interested in conditional Role-Based access depending on physical location. This could certainly be satisfied by introducing multiple search heads and using a combination of NAC and Splunk's RBAC features.

Search Head 1:  High Security Environment
Using NAC this search head would only be network accessible from "High Security Environments" and using Splunk's RBAC would allow a user to see all his/her classified Star fleet messages.

Search Head 2: Bridge
Using NAC this search head would only be network accessible from "the Bridge" and using Splunk's RBAC would allow a user to see all his/her non-classified messages.

[hazekamp]

For a single search head, please file an enhancement request with support@splunk.com for Splunk's RBAC to consider a user's source address/network.

[MuS]

Hi hazekamp, thanks for the answer. you got it right, but how could this be done with just one search head? we already came up to the solution with two search heads.