Need Help Restricting Results

[menkurau]

I am trying to provide our data center customers a view of their firewall permits and denies (based on cisco fwsm logs). The requirements I have been given are to restrict what a customer can search for to either events for their source or destination and by period of time the own the IP. Also, this cannot be a separate app. I need to figure out a way to restrict certain events to certain users based on the source and destination IP and time.

I have a lookup file that specifies a subnet for CIDR matching and has columns for mapping ownership to a customer by IP. The lookup also has a column to reference a date code for both the source and destination IP so I can exclude results by event time.

I have a search that fulfills the requirements, however, I can't figure out a way to restrict results by role. It is a pipeline search, so I can't create an eventtype. My understanding of summary indicies preclude their use. My thinking is the only way to do it is to create an app, but the requirements specify no.

Here is an example of one of the searches:

owner_src="FAC" OR owner_dst="FAC" type="Built" OR type="Deny" 
| convert timeformat="%m%d%y" ctime(_time) as c_time 
| eval owner_valid_src = if(c_time >= date_filter_src, "Yes", "No") 
| eval owner_valid_dst = if(c_time >= date_filter_dst, "Yes", "No") 
| search owner_valid_src="yes" OR owner_valid_dst="yes"

[dart]

I think you want to convert your lookup to be an automatic time based lookup, and then use the search filter in the role for each customer on the owner_src and owner_dst fields. That way you do not need the convert, evals and 2nd search.

[menkurau]

Currently four, but there are likely to be more as we add new customers.

[jonuwz]

How many roles will this scale to ?