Security

set up an account for splunk developer

rajul_jain
New Member

In our Splunk infra, we have so many developers creating objects. We had just faced a problem when few number of employee left organization and their alerts stopped working as the owner(employee) id was disabled from active directory. Also objects were created using own id's.
We thought of creating a group contains all the developers and share the password with all. So that none of the object will be disabled after user/developer leave company. We did not find it optimal from security point of view. Can anyone suggest for this issue?

0 Karma

acharlieh
Influencer

So as I'm sure you've found, a Splunk Admin can change Ownership of objects through the REST API as detailed in this answer

So simple options include either be part of the off boarding process and transfer ownership of Splunk objects to another employee. OR have a process by which Splunk objects are "promoted" to be owned by a generic user that no one has to log in as.

At my company I'm pushing to moving to the idea that developers can work within test apps / environments all they want, but to go to production, they need to package custom Splunk App(s) which are managed in source control, peer-reviewed, and installed in appropriate environments by our configuration management solution (Chef). But that's going to take a while to get there 🙂

alacercogitatus
SplunkTrust
SplunkTrust

Agreed. I'm actually working on a version controlled, Continuous integration environment for a client. No direct updates on the Splunk environment. 😄

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...