Splunk Enterprise

Securing Authorization and Authentication of Splunk rest API call

kannu
Communicator
Hello Splunkers,
 

I’m working on developing an app that requires making REST API calls to Splunk in order to gather information about saved searches, knowledge objects, and more.

Could you please advise on the most secure method for authorization and authentication? Does the REST API support MFA, or are there other mechanisms available, with or without SAML?

Is token generation the only secure way to make these API calls, or are there alternative methods?

Thanks 

Manish Kumar

 

Labels (1)
Tags (2)
0 Karma
1 Solution

sainag_splunk
Splunk Employee
Splunk Employee
  1. Token Authentication: This is definitely your best bet for security. You can create these through Splunk Web or via the API itself.  https://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTtoken
  2. HTTPS: Always, always use HTTPS for your API calls. It's a must for encryption.
  3. RBAC Make sure your API user or token only has the permissions it absolutely needs. Less is more when it comes to security! Create splunk roles and map accordingly.
  4. MFA: While Splunk supports MFA for user logins, it's not directly used for API calls. Instead, you'd set up MFA for the user generating the API tokens. https://docs.splunk.com/Documentation/SIM/current/User/SetupMFA

  5. SAML: If you're using SAML, you'll still use tokens for API access. SAML is more for the web interface.

Tokens are usually the way to go for most scenarios.

https://docs.splunk.com/Documentation/SplunkCloud/latest/Security/SetupuserauthenticationwithSplunk
https://docs.splunk.com/Documentation/Splunk/9.3.1/Security/UseAuthTokens

 

Hope this helps!

If this helps, Upvote!!!!
Together we make the Splunk Community stronger 

View solution in original post

0 Karma

sainag_splunk
Splunk Employee
Splunk Employee
  1. Token Authentication: This is definitely your best bet for security. You can create these through Splunk Web or via the API itself.  https://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTtoken
  2. HTTPS: Always, always use HTTPS for your API calls. It's a must for encryption.
  3. RBAC Make sure your API user or token only has the permissions it absolutely needs. Less is more when it comes to security! Create splunk roles and map accordingly.
  4. MFA: While Splunk supports MFA for user logins, it's not directly used for API calls. Instead, you'd set up MFA for the user generating the API tokens. https://docs.splunk.com/Documentation/SIM/current/User/SetupMFA

  5. SAML: If you're using SAML, you'll still use tokens for API access. SAML is more for the web interface.

Tokens are usually the way to go for most scenarios.

https://docs.splunk.com/Documentation/SplunkCloud/latest/Security/SetupuserauthenticationwithSplunk
https://docs.splunk.com/Documentation/Splunk/9.3.1/Security/UseAuthTokens

 

Hope this helps!

If this helps, Upvote!!!!
Together we make the Splunk Community stronger 
0 Karma

PickleRick
SplunkTrust
SplunkTrust

From the security standpoint token authentication doesn't differ from user/password authentication. It's still authentication with a static secret.

You can't use SAML for REST API authentication.

You might want to think about integrating an external credentials provider like Conjur and rotating the tokens often

Get Updates on the Splunk Community!

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...

Stay Connected: Your Guide to October Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...