Splunk Search

Restrict search command usage (rest in particular)

JacobPN
Path Finder

I am looking to restrict the use of certain search commands for particular users / roles.
In particular I would like users not to be able to use the rest command.

I have created a role and only added the capabilities change_own_password, rtsearch, and search, while also restricting search access to two (empty) indexes. However, using the this query:

| rest services/data/indexes

users will still be able to see all indexes (on the standalone server). Is there a way to prevent this?

0 Karma

jbrocks
Communicator

You can finde a documentation about capabilities here. there are even some capabilities for the rest api e.g. dispatch_rest_to_indexers

https://docs.splunk.com/Documentation/Splunk/latest/Admin/Authorizeconf?utm_source=answers&utm_mediu...
0 Karma

JacobPN
Path Finder

Thank you for your answer. I found the dispatch_rest_to_indexers capability. However the current Splunk setup is a standalone server. So not assigning this capability doesn't help in this case (in fact, I didn't assign it and the mentioned rest query can still be used). I think I need to disable the rest command all together somehow. Do you know if that's possible?

0 Karma

jbrocks
Communicator

I think you can use the restmap.conf to disable the restapi e.g. with acceptFrom

acceptFrom=<network_acl> ...
* Lists a set of networks or addresses to allow this endpoint to be accessed
  from.
* This shouldn't be confused with the setting of the same name in the
  [httpServer] stanza of server.conf which controls whether a host can
  make HTTP requests at all
* Each rule can be in the following forms:
    1. A single IPv4 or IPv6 address (examples: "10.1.2.3", "fe80::4a3")
    2. A CIDR block of addresses (examples: "10/8", "fe80:1234/32")
    3. A DNS name, possibly with a '*' used as a wildcard (examples:
       "myhost.example.com", "*.splunk.com")
    4. A single '*' which matches anything
* Entries can also be prefixed with '!' to cause the rule to reject the
  connection.  Rules are applied in order, and the first one to match is
  used.  For example, "!10.1/16, *" will allow connections from everywhere
  except the 10.1.*.* network.
* Defaults to "*" (accept from anywhere)

Find the docu here: https://docs.splunk.com/Documentation/Splunk/7.2.4/Admin/Restmapconf

Hope this helps!

0 Karma

JacobPN
Path Finder

Thanks for the reply! I have tried this, but I'm not sure what to edit exactly. Could you provide an example that would disable the particular rest command I mentioned?
Also, I'm not sure that whitelisting an ip-address would work? Wouldn't the rest command from the search bar use localhost? Haven't been able to try this, since I'm not sure what to edit in de restmap.conf file.

0 Karma

Bar_Ronen
Loves-to-Learn Lots

Still have this issue?

I’ve found a solution for that. 

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...