Splunk Search

How to restrict search access to certain hosts or fields on a per-user basis?

jhillenburg
Path Finder

Hello. I'm new to Splunk. This may become obvious with my next question: I would like to restrict access to certain hosts or fields on a per-user basis. IE. I might want our Help Desk to not be able to access the logs for a certain server, or I may want to give them access to data for a given server but not be able to view a particular field. What methods have people used for this? Thanks.

1 Solution

yannK
Splunk Employee
Splunk Employee

"I might want our Help Desk to not be able to access the logs for a certain server"

This is easy, if you segment your data per index and use the roles to control the access.
This is also an unbreakable method.
example in the inputs specify the index, and use 2 versions of each index one public, one private, and use a wildcard in your searches.

Example : with the indexes database-public and database-secure
use a search like index=database-*

"I may want to give them access to data for a given server but not be able to view a particular field"

This is the hard part, the only solution that splunk propose is a the role search limits, by adding a mandatory search condition.

By example :
for the RoleA, always add "AND host!=securehost" to the main search conditions.

View solution in original post

tedwroks
Explorer

Is it possible:

  1. use a report and give access to the role/user you want to restrict access.
  2. have this report run using the owner (who has access to the event/fields).
  3. the report returns a table with only the fields that should be accessible to the user/role.
  4. remove access to the event/index for the user/role

In a way, this is using reports (or a data model) to give access to something, even though the underlying events/index is not accessible by the user/role.

0 Karma

ppablo
Retired

Hi @jhillenburg

Just following up, but did @aljohnson_splunk or @yannK's answers help solve your question? If yes, be sure to accept the appropriate answer by clicking on "Accept" below the response. If you're still having issues, it'd be great if you could comment on the answers below to to find the answers and resolve this post. Thanks!

Patrick

0 Karma

yannK
Splunk Employee
Splunk Employee

"I might want our Help Desk to not be able to access the logs for a certain server"

This is easy, if you segment your data per index and use the roles to control the access.
This is also an unbreakable method.
example in the inputs specify the index, and use 2 versions of each index one public, one private, and use a wildcard in your searches.

Example : with the indexes database-public and database-secure
use a search like index=database-*

"I may want to give them access to data for a given server but not be able to view a particular field"

This is the hard part, the only solution that splunk propose is a the role search limits, by adding a mandatory search condition.

By example :
for the RoleA, always add "AND host!=securehost" to the main search conditions.

aljohnson_splun
Splunk Employee
Splunk Employee
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...