Security

How to masking data by Role-based on Splunk Cloud?

yottanat2021
Explorer

I want to masking data by Role-based on Splunk Cloud.

Labels (3)
Tags (3)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @yottanat2021,

for my knowledge, it isn't possible to mask data at search time.

You can block the access to the row data, disabling the open in search feature in all the dashboards enabled for that role, and permit only access to some dashboards with a subset of fields.

This means that you must create different dashboards for each role!

Access to data is managed in Splunk at index level, in other words, if a role is enabled to see the events stored in an index, it can see all the data,

but, as I said, you can only block the access to the raw data and permit access to data only using a limited dashboard.

Ciao.

Giuseppe

View solution in original post

yottanat2021
Explorer

Hi @gcusello,

Thank your for reply.

I want to masking data at search-time on Splunk Cloud.


Example like this:

[1] Enable role-based field filtering feature
file: /opt/splunk/etc/system/local/limits.conf
#
[search]
role_based_field_filtering = true

[2] Config field filtering for user role (not support on UI, manual edit only), example role name is "staff"
file: /opt/splunk/etc/system/local/authorize.conf
#
[role_staff]
fieldFilter-host = SHA256
fieldFilter-_raw = s/output_mode=[^ ']+/output_mode=HIDDEN/g
fieldFilterLimit = sourcetype::audittrail
importRoles = user

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @yottanat2021,

for my knowledge, it isn't possible to mask data at search time.

You can block the access to the row data, disabling the open in search feature in all the dashboards enabled for that role, and permit only access to some dashboards with a subset of fields.

This means that you must create different dashboards for each role!

Access to data is managed in Splunk at index level, in other words, if a role is enabled to see the events stored in an index, it can see all the data,

but, as I said, you can only block the access to the raw data and permit access to data only using a limited dashboard.

Ciao.

Giuseppe

yottanat2021
Explorer

Hi @gcusello,

Thank you for your guidance help me so much. 😀

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @yottanat2021,

could you better describe your requirement?

are you speaking of data masking at index time or at search time?

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...