Security

Is data scrubbing only available for specified roles?

mcarpentier
Engager

Hi all,
I know Splunk can replace identifying datas at search time, however I don't know if this can be done for specified roles only?
Many employees in our company may not have the necessary accreditation to view our customers' IP or emails, but I'd like them to access scrubbed logs. While others may have full access to the unscrubbed logs.

Is this possible via Splunk ? Thanks for your answer.

0 Karma
1 Solution

esix_splunk
Splunk Employee
Splunk Employee

There's no out of the box capability for this. I'll also point out, if your taking about accreditation requirements, typically search time masking is insufficient as users can still drill down / search the raw. Index time masking is the only solution in that sort of scenario.

ThAt being said, you could used role based access control to create indexes based on roles, and scrub data on a per index basis. However that's a long and tedious process and would require full time admins to do this. You'd basically have to index the data, then use summary indexing to collect and scrub the existing data. Very time consuming.

View solution in original post

esix_splunk
Splunk Employee
Splunk Employee

There's no out of the box capability for this. I'll also point out, if your taking about accreditation requirements, typically search time masking is insufficient as users can still drill down / search the raw. Index time masking is the only solution in that sort of scenario.

ThAt being said, you could used role based access control to create indexes based on roles, and scrub data on a per index basis. However that's a long and tedious process and would require full time admins to do this. You'd basically have to index the data, then use summary indexing to collect and scrub the existing data. Very time consuming.

mcarpentier
Engager

Thanks, didn't know about summary indexing, gonna read some documentation on this.
If i create two indexes, one scrubbed and one with raw events, does that means i'll be charged twice (talking about license) ?
Also i'm not used to splunk yet to understand how much time consuming would that be, i'd imagine splunk can automatically do this....but if you say so i trust you !

0 Karma

twinspop
Influencer

Summary indexing doesn't count against your license. Yes, it could be done automatically, but will probably require non-trivial care and feeding.

0 Karma

mcarpentier
Engager

perfect, thanks !

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...