Within my organization, I need to restrict access to certain log source to some department, How this can achieved?
For example, we have network team, system engineering team, data base team and Application team
I do not want the application team to poke nose into network team data. how this can achieved??.
Hint : Network team : Routers, Switches, Firewalls, IPS, WAF
System Engineering team : Vmware, Servers, storage
Is there any way to compartmentalize??
Thanks in advance
Splunk supports role based access control which can be leveraged to address your requirement. Also you can create separate index for each team & assign it to respective team. More information is available on below link -
http://docs.splunk.com/Documentation/Splunk/6.2.2/Security/UseaccesscontroltosecureSplunkdata