Security

How can we specify authorization at data input level?

alankar
Engager

How can we specify authorization at data input source level? Like I created a TCP source, but I want it to be available (while searching) to a specific group/role/user only. Not for everyone.

Tags (2)
1 Solution

the_wolverine
Champion

You could specify a custom index within the input configuration. For example:

[monitor:///var/log/custom.log]
index = special

You can then create a custom role which allows only access to this index by modifying authorize.conf:

[role_custom]
importRoles = user
srchIndexesDefault = special
srchIndexesAllowed = special

To ensure other roles are unable to access this special index, you should verify that the srchIndexes* settings do not specify * or the special index.

View solution in original post

the_wolverine
Champion

You could specify a custom index within the input configuration. For example:

[monitor:///var/log/custom.log]
index = special

You can then create a custom role which allows only access to this index by modifying authorize.conf:

[role_custom]
importRoles = user
srchIndexesDefault = special
srchIndexesAllowed = special

To ensure other roles are unable to access this special index, you should verify that the srchIndexes* settings do not specify * or the special index.

Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...