Splunk Search

Anonymize certain fields during search time field extraction per role

yuwtennis
Communicator

Hi!

I would like to know the best way to anonymize certain fields per role base in search time field extraction.

For example,

If I prepare

userA - roleA
userB - roleB

and raw data ,

a,b,c
1,2,3

i want to make userA see
a,b,c
1,2,3

but userB not see field b
a,b,c
1,0,3

I believe usually this can be implemented in index-time by creating extra index which has field b masked as 0.
But what would be the best way to implement in search time?

Thanks,
Yu

Tags (2)
1 Solution

sciurus
Path Finder

Security is applied at the index layer, any attempts to impose security at search time will ultimately fail if someone is determined. If the data must be hidden, then it must be done at the index level.

Having said that though, if you still want to do it at search time then I would guess you make a pre-defined search or dashboard that extracts a set of fields they're "allowed" to see, and hope they don't fiddle with it or find a way to access _raw.

View solution in original post

sciurus
Path Finder

Security is applied at the index layer, any attempts to impose security at search time will ultimately fail if someone is determined. If the data must be hidden, then it must be done at the index level.

Having said that though, if you still want to do it at search time then I would guess you make a pre-defined search or dashboard that extracts a set of fields they're "allowed" to see, and hope they don't fiddle with it or find a way to access _raw.

yuwtennis
Communicator

Hello sciurus.

Thank you for the comment.

I decided to do it in the index level.

Thanks,
Yu

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...