searching in splunk indexes

[user487596]

Hello everyone! How can we solve the problem of searching for secrets in all or some splunk indexes so that splunk is not heavily loaded: how can this be implemented? (approach). 

It is obvious that the list of indexes needs to be limited. What else?

[user487596]

HI, @gcusello 
I need to find secrets (passwords, api-tokens, etc.) in all data (events) in all indexes that are in splunk, the question is in the approach: how to do this so as not to overload splunk.

[gcusello]

Hi @user487596 ,

Splunk is a search engine, so you can use it for this:

you must know the rules (e.g. searching for the password word) and then apply to the indexes.

At first I'd start identifying the login and create user actions for each environment in your infrastructure (e.g. in windows these action are identifed with EventCode = 4624 and 4720), then you can run searches with those specific filters to see if there are clear text passwords.

Ciao.

Giuseppe

[user487596]

@gcusello , It's pretty clear what to look for, the question is how to do it in all indexes without loading splunk

[gcusello]

Hi @user487596 ,

sorry but I don't understand: what do you mean with "in all indexes without loading splunk"?

You could use APIs to access Splunk from your application without using the Splunk GUI.

Ciao.

Giuseppe

[gcusello]

Hi @user487596 ,

could you better describe your requisite?

In Splunk access to data is managed at index level, in other words, you can define for each role, which are the indexes that the users with that role can access.

In addition, it's also possible to add some additional restrictions, but always at Role level, not user level.

Ciao.

Giuseppe