Monitoring Splunk

What is the best way to design/define roles?

chris
Motivator

Hi

We had a little discussion about splunk architectures and how roles should be designed.
I was wondering if anyone has any hints/best practices to define roles.

My approach so far was to build indexes that are then assigned to roles in authorize.conf using the 'srchIndexesAllowed'. I try not to use the 'srchFilter' parameter if I can avoid it. I think that 'srchFilter' will have performance impacts and I created a mess once using inheritance and different search filters.

Regarding the capabilities I usually derive from the 'user' or 'power' role which are fine for 95% of the roles I have to define.

Feedback is appreciated

Chris

Tags (3)
1 Solution

lguinn2
Legend

I also avoid using the search filter for roles. Once upon a time, it was about the only way to effectively segregate data. Occasionally, it is still useful. Like you, I believe that it adds unnecessary complexity without great benefits.

I like to have two types of roles:

  • roles that grant privileges (power, user, etc) BUT no data access. These roles do not give access to ANY indexes, not even main. Important: inheriting from a role that has index access will also inherit the index access, so be careful with the default roles!
  • roles that grant only basic user privileges AND give access to one or more indexes.

Each user is assigned at least two roles: one for their capabilities and one for their index access.

This lets me keep a very clean set of roles. I got the idea from Gerald, of course; the #1 ranked person on Splunk Answers!

View solution in original post

lguinn2
Legend

I also avoid using the search filter for roles. Once upon a time, it was about the only way to effectively segregate data. Occasionally, it is still useful. Like you, I believe that it adds unnecessary complexity without great benefits.

I like to have two types of roles:

  • roles that grant privileges (power, user, etc) BUT no data access. These roles do not give access to ANY indexes, not even main. Important: inheriting from a role that has index access will also inherit the index access, so be careful with the default roles!
  • roles that grant only basic user privileges AND give access to one or more indexes.

Each user is assigned at least two roles: one for their capabilities and one for their index access.

This lets me keep a very clean set of roles. I got the idea from Gerald, of course; the #1 ranked person on Splunk Answers!

Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...