Hello,
I am looking to generate a report which indicates the current roles and for each role:
I was hoping there may be an app which someone has already pulled together but I can't see anything in Splunk Base that looks relevant.
In terms of a search query, I have been playing with the below query which shows the user and the actions they have performed. Clearly this is not quite right as I want it to start with the role, then show which indexes the role can access and the capabilities specific to the role. It does show that the role has been used though which is helpful.
index=_audit user=* action=* | dedup user action | stats list(action) AS actions by user
Any thoughts, suggestions?
Cheers,
P
This search should get you most of the way there
| rest /services/authentication/users | mvexpand roles | table realname, title, roles, email | join roles [ rest /services/authorization/roles | rename title as roles | search srchIndexesAllowed=* | table roles srchIndexesAllowed]
You will want to remove the "All Internal Indexes" search ability on the user role.
Then create a custom role for each group with access to only the indexes they should see.
The other searches should be possible using a combination of
| rest /services/authorization/roles
and
| rest /services/authentication/users