Security
Highlighted

How does multitenancy work in Splunk to restrict access to certain data for each team using Splunk in our organization?

New Member

Within my organization, I need to restrict access to certain log source to some department, How this can achieved?

For example, we have network team, system engineering team, data base team and Application team

I do not want the application team to poke nose into network team data. how this can achieved??.

Hint : Network team : Routers, Switches, Firewalls, IPS, WAF
System Engineering team : Vmware, Servers, storage

Is there any way to compartmentalize??

Thanks in advance

0 Karma
Highlighted

Re: How does multitenancy work in Splunk to restrict access to certain data for each team using Splunk in our organization?

Builder

Splunk supports role based access control which can be leveraged to address your requirement. Also you can create separate index for each team & assign it to respective team. More information is available on below link -
http://docs.splunk.com/Documentation/Splunk/6.2.2/Security/UseaccesscontroltosecureSplunkdata