I am looking to restrict the use of certain search commands for particular users / roles.
In particular I would like users not to be able to use the
I have created a role and only added the capabilities
search, while also restricting search access to two (empty) indexes. However, using the this query:
| rest services/data/indexes
users will still be able to see all indexes (on the standalone server). Is there a way to prevent this?
You can finde a documentation about capabilities here. there are even some capabilities for the rest api e.g.
Thank you for your answer. I found the
dispatch_rest_to_indexers capability. However the current Splunk setup is a standalone server. So not assigning this capability doesn't help in this case (in fact, I didn't assign it and the mentioned
rest query can still be used). I think I need to disable the
rest command all together somehow. Do you know if that's possible?
I think you can use the
restmap.conf to disable the restapi e.g. with
acceptFrom=<network_acl> ... * Lists a set of networks or addresses to allow this endpoint to be accessed from. * This shouldn't be confused with the setting of the same name in the [httpServer] stanza of server.conf which controls whether a host can make HTTP requests at all * Each rule can be in the following forms: 1. A single IPv4 or IPv6 address (examples: "10.1.2.3", "fe80::4a3") 2. A CIDR block of addresses (examples: "10/8", "fe80:1234/32") 3. A DNS name, possibly with a '*' used as a wildcard (examples: "myhost.example.com", "*.splunk.com") 4. A single '*' which matches anything * Entries can also be prefixed with '!' to cause the rule to reject the connection. Rules are applied in order, and the first one to match is used. For example, "!10.1/16, *" will allow connections from everywhere except the 10.1.*.* network. * Defaults to "*" (accept from anywhere)
Find the docu here:
Hope this helps!
Thanks for the reply! I have tried this, but I'm not sure what to edit exactly. Could you provide an example that would disable the particular rest command I mentioned?
Also, I'm not sure that whitelisting an ip-address would work? Wouldn't the rest command from the search bar use localhost? Haven't been able to try this, since I'm not sure what to edit in de