Security

Is there currently an app or search for reporting on Splunk Roles and Users? (searchable indexes, capabilities, list of users, activity, etc)

pjb2160
Path Finder

Hello,

I am looking to generate a report which indicates the current roles and for each role:

  • What indexes the role has visibility of
  • What capabilities are specific to the role
  • Which users can use the role; and
  • Whether each user has used the role in a period of time (as controlled by the time picker)

I was hoping there may be an app which someone has already pulled together but I can't see anything in Splunk Base that looks relevant.

In terms of a search query, I have been playing with the below query which shows the user and the actions they have performed. Clearly this is not quite right as I want it to start with the role, then show which indexes the role can access and the capabilities specific to the role. It does show that the role has been used though which is helpful.

index=_audit user=* action=* | dedup user action | stats list(action) AS actions by user

Any thoughts, suggestions?

Cheers,
P

0 Karma

phoenixdigital
Builder

This search should get you most of the way there

| rest /services/authentication/users | mvexpand roles | table realname, title, roles, email | join roles [ rest /services/authorization/roles | rename title as roles | search srchIndexesAllowed=* | table roles srchIndexesAllowed]

alt text

You will want to remove the "All Internal Indexes" search ability on the user role.

Then create a custom role for each group with access to only the indexes they should see.

The other searches should be possible using a combination of

| rest /services/authorization/roles

and

| rest /services/authentication/users
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...