Security

How to masking data by Role-based on Splunk Cloud?

yottanat2021
Explorer

I want to masking data by Role-based on Splunk Cloud.

Labels (2)
Tags (3)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @yottanat2021,

for my knowledge, it isn't possible to mask data at search time.

You can block the access to the row data, disabling the open in search feature in all the dashboards enabled for that role, and permit only access to some dashboards with a subset of fields.

This means that you must create different dashboards for each role!

Access to data is managed in Splunk at index level, in other words, if a role is enabled to see the events stored in an index, it can see all the data,

but, as I said, you can only block the access to the raw data and permit access to data only using a limited dashboard.

Ciao.

Giuseppe

View solution in original post

yottanat2021
Explorer

Hi @gcusello,

Thank your for reply.

I want to masking data at search-time on Splunk Cloud.


Example like this:

[1] Enable role-based field filtering feature
file: /opt/splunk/etc/system/local/limits.conf
#
[search]
role_based_field_filtering = true

[2] Config field filtering for user role (not support on UI, manual edit only), example role name is "staff"
file: /opt/splunk/etc/system/local/authorize.conf
#
[role_staff]
fieldFilter-host = SHA256
fieldFilter-_raw = s/output_mode=[^ ']+/output_mode=HIDDEN/g
fieldFilterLimit = sourcetype::audittrail
importRoles = user

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @yottanat2021,

for my knowledge, it isn't possible to mask data at search time.

You can block the access to the row data, disabling the open in search feature in all the dashboards enabled for that role, and permit only access to some dashboards with a subset of fields.

This means that you must create different dashboards for each role!

Access to data is managed in Splunk at index level, in other words, if a role is enabled to see the events stored in an index, it can see all the data,

but, as I said, you can only block the access to the raw data and permit access to data only using a limited dashboard.

Ciao.

Giuseppe

yottanat2021
Explorer

Hi @gcusello,

Thank you for your guidance help me so much. 😀

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @yottanat2021,

could you better describe your requirement?

are you speaking of data masking at index time or at search time?

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...