Splunk Search

Restrict search command usage (rest in particular)

JacobPN
Path Finder

I am looking to restrict the use of certain search commands for particular users / roles.
In particular I would like users not to be able to use the rest command.

I have created a role and only added the capabilities change_own_password, rtsearch, and search, while also restricting search access to two (empty) indexes. However, using the this query:

| rest services/data/indexes

users will still be able to see all indexes (on the standalone server). Is there a way to prevent this?

0 Karma

jbrocks
Communicator

You can finde a documentation about capabilities here. there are even some capabilities for the rest api e.g. dispatch_rest_to_indexers

https://docs.splunk.com/Documentation/Splunk/latest/Admin/Authorizeconf?utm_source=answers&utm_mediu...
0 Karma

JacobPN
Path Finder

Thank you for your answer. I found the dispatch_rest_to_indexers capability. However the current Splunk setup is a standalone server. So not assigning this capability doesn't help in this case (in fact, I didn't assign it and the mentioned rest query can still be used). I think I need to disable the rest command all together somehow. Do you know if that's possible?

0 Karma

jbrocks
Communicator

I think you can use the restmap.conf to disable the restapi e.g. with acceptFrom

acceptFrom=<network_acl> ...
* Lists a set of networks or addresses to allow this endpoint to be accessed
  from.
* This shouldn't be confused with the setting of the same name in the
  [httpServer] stanza of server.conf which controls whether a host can
  make HTTP requests at all
* Each rule can be in the following forms:
    1. A single IPv4 or IPv6 address (examples: "10.1.2.3", "fe80::4a3")
    2. A CIDR block of addresses (examples: "10/8", "fe80:1234/32")
    3. A DNS name, possibly with a '*' used as a wildcard (examples:
       "myhost.example.com", "*.splunk.com")
    4. A single '*' which matches anything
* Entries can also be prefixed with '!' to cause the rule to reject the
  connection.  Rules are applied in order, and the first one to match is
  used.  For example, "!10.1/16, *" will allow connections from everywhere
  except the 10.1.*.* network.
* Defaults to "*" (accept from anywhere)

Find the docu here: https://docs.splunk.com/Documentation/Splunk/7.2.4/Admin/Restmapconf

Hope this helps!

0 Karma

JacobPN
Path Finder

Thanks for the reply! I have tried this, but I'm not sure what to edit exactly. Could you provide an example that would disable the particular rest command I mentioned?
Also, I'm not sure that whitelisting an ip-address would work? Wouldn't the rest command from the search bar use localhost? Haven't been able to try this, since I'm not sure what to edit in de restmap.conf file.

0 Karma

Bar_Ronen
Loves-to-Learn Lots

Still have this issue?

I’ve found a solution for that. 

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...