Security

how to implement external data authorisation

eriklund
New Member

I have a use-case where a Splunk end-user should only be allowed to search on a subset of events in an index. For example, restrict the end-user to only be able to search for customer's data which the end-user has authorisation to.

Is there a smart way of doing this in Splunk?
I looked into different solutions like Splunk Apps, External Lookup, Custom parameters in OAuth...

Building a new front-end app and use the Splunk search API is one way, however, that is probably not the smartes ways of doing it. 


I guess that I'm not the first one that has this use-case.

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Access to an index is all or none.  Splunk does not have a means for selective access to data within an index.  In fact, one of the criteria for creating a new index is different security needs.  IOW, each customer's data should be in its own index(es).

You can try defining a search filter (customer=foo, perhaps) for the end user, but that will apply to all indexes and so may not be a workable solution.

---
If this reply helps you, Karma would be appreciated.

eriklund
New Member

Thanks for fast response. As we are talking millions of customers that would not scale. 
I'll go for a Splunk API based solution then.

0 Karma

PickleRick
SplunkTrust
SplunkTrust

It does sound like a very peculiar use case. Maybe not even very well suited to searching Splunk directly. You definitely should try to engage Splunk Consultant to talk over your needs - maybe you need some form of middleware or a completely different approach to data access.

0 Karma

isoutamo
SplunkTrust
SplunkTrust
Hi
If/when you have millions of customers which all have their own datasets which should see/use only that customer you have quite interesting challenge.
I really propose that you as help from Splunk Partner on your local area and they could ask more help from Splunk to figure out if there is any reasonable way to do this.
r. Ismo
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...