Security

Captain Picard's Star fleet messages

SplunkTrust
SplunkTrust

Hi Splunk- and other Gurus

Assumption:

Captain Picard's room is a high security Environment, so him and only himself is allowed to read all the high classified Star fleet messages. if Captain Picard is called to the Bridge, he also can read his private messages but not the high classified messages although he is identified as Captain Picard.

Is there a way to filter/handle this in Splunk for example by search origin or by user role?

cheers, MuS

Tags (2)
1 Solution

Builder

Mus,

If I understand correctly you are interested in conditional Role-Based access depending on physical location. This could certainly be satisfied by introducing multiple search heads and using a combination of NAC and Splunk's RBAC features.

Search Head 1:  High Security Environment
Using NAC this search head would only be network accessible from "High Security Environments" and using Splunk's RBAC would allow a user to see all his/her classified Star fleet messages.

Search Head 2: Bridge
Using NAC this search head would only be network accessible from "the Bridge" and using Splunk's RBAC would allow a user to see all his/her non-classified messages.

View solution in original post

Builder

Mus,

If I understand correctly you are interested in conditional Role-Based access depending on physical location. This could certainly be satisfied by introducing multiple search heads and using a combination of NAC and Splunk's RBAC features.

Search Head 1:  High Security Environment
Using NAC this search head would only be network accessible from "High Security Environments" and using Splunk's RBAC would allow a user to see all his/her classified Star fleet messages.

Search Head 2: Bridge
Using NAC this search head would only be network accessible from "the Bridge" and using Splunk's RBAC would allow a user to see all his/her non-classified messages.

View solution in original post

Builder

For a single search head, please file an enhancement request with support@splunk.com for Splunk's RBAC to consider a user's source address/network.

0 Karma

SplunkTrust
SplunkTrust

Hi hazekamp, thanks for the answer. you got it right, but how could this be done with just one search head? we already came up to the solution with two search heads.

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!