Is there currently an app or search for reporting on Splunk Roles and Users? (searchable indexes, capabilities, list of users, activity, etc)

[pjb2160]

Hello,

I am looking to generate a report which indicates the current roles and for each role:

• What indexes the role has visibility of
• What capabilities are specific to the role
• Which users can use the role; and
• Whether each user has used the role in a period of time (as controlled by the time picker)

I was hoping there may be an app which someone has already pulled together but I can't see anything in Splunk Base that looks relevant.

In terms of a search query, I have been playing with the below query which shows the user and the actions they have performed. Clearly this is not quite right as I want it to start with the role, then show which indexes the role can access and the capabilities specific to the role. It does show that the role has been used though which is helpful.

index=_audit user=* action=* | dedup user action | stats list(action) AS actions by user

Any thoughts, suggestions?

Cheers,
P

[phoenixdigital]

This search should get you most of the way there

| rest /services/authentication/users | mvexpand roles | table realname, title, roles, email | join roles [ rest /services/authorization/roles | rename title as roles | search srchIndexesAllowed=* | table roles srchIndexesAllowed]

You will want to remove the "All Internal Indexes" search ability on the user role.

Then create a custom role for each group with access to only the indexes they should see.

The other searches should be possible using a combination of

| rest /services/authorization/roles

and

| rest /services/authentication/users