Splunk Enterprise Security

RBAC for Notable events?

jack_lang
New Member

Hi,

 

Imagine the role `A` has access to index=foobar, but roles 'B' and 'C' do not. Imagine Splunk Enterprise Security creates a notable event / alert based on data in index=foobar. Is it possible to ensure only members in 'A' can see the alert, and 'B' and 'C' cannot? How?

More broadly, is this possible outside of Enterprise Security too? How?

Appreciate any help!

 

 

Labels (1)
0 Karma

hettervik
Builder

In general, as notable events are stored in a separate index (called "notable"), the permission for the indexes for the original events doesn't apply anymore. However, I guess you could add the index field from the original events to the notable event, call it e.g. "original_index", and then create a search filters for different user groups, so that for example users with access to index "foobar" can only see notable events with "original_index=foobar".

I'm not sure how this would work for incidents in Splunk ES though, as I understand that viewing incidents in the "Incident Review" in Splunk ES is not the same as looking up events from the notable index per se, and that search filters might not apply here.

0 Karma
Get Updates on the Splunk Community!

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...

Cloud Platform | Discontinuing support for TLS version 1.0 and 1.1

Overview Transport Layer Security (TLS) is a security communications protocol that lets two computers, ...

Splunk Cloud Platform | New Customer Testimonials

Enterprises of all sizes and across different industries are accelerating cloud adoption by migrating ...