Security

How to limit access to users own data?

las
Contributor

Hi.

We are going to have a datasource with some sensitive data, where there is a requirement, that only the owner of a specific event is allowed to see it.

The events will have the user as part of the data, that field can be created as an indexed field.

I will, of course, have the data in a separate index, and thought I might be able to use restriction to limit access so that the user only can search in data where the field user matches the logged on user.

I can see it is possible to use the token $env.user$ in a dashboard, but I would really like to use it in the restrictions part of the role, so it automatically will use the logged on user in the restriction.

 

Any help will be much appreciated.

Kind regards

las

 

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @las,

for my knowledge a user can access the full events in an index and it isn't possible to eneble view of only a part of an event.

The only solution is a workaround:

  • define a new role, adding the user with limited data access,
  • create a summary index containng only the information that the user can see,
  • enable the above new role to access the summary index,
  • create a dashboard for the user accessing the Summary index.

Ciao.

Giuseppe

0 Karma

las
Contributor

Hi Guiseppe.

I might have expressed myself a littele clumsy, I do not want the users to see part of an event, but only a subset of events in the index.

There is functionality available to limit searches using indexed fields (Restrictions), so the question is really, how do I get the user that is logged on into this role.

 

Kind regards

las

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @las,

you have to create two (or more) roles dividing the users betweeen them and creating a restriction for one of these roles.

Ciao.

Giuseppe

0 Karma

las
Contributor

Hi Guiseppe.

Yes, the question is if I can make the restriction dynamic based on the user that is logged in?

Kind regards

las

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @las,

yes it's possible assigning the user to a role, then you give to each role the correct restrictions, but anyway the management is done using roles.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...