Security

How to restrict index access to a subset of events, while allowing full access to other indexes?

adamblock2
Path Finder

I am interested in allowing a limited number of network users to access specific Windows events. The network users are currently members of a "company_user_network" role. I would like to create a second role for the purpose of assigning access to the subset of Windows events.

Role: company_wineventsubset_user
restrict search terms: eventtype=wineventsubset
inherited roles:

indexes searched by default: All non-internal indexes
restrict access to index: wineventlog

Role: company_user_network
inherited roles: user
indexes searched by default: firewall, network, vpn, web
restrict access to index: firewall, network, vpn, web

User: user_test
selected roles: company_user_network, company_wineventsubset_user

I have attempted using the above configurations. Unfortunately, the "restrict search terms: eventtype=wineventsubset" is being applied to both roles, not just the "company_wineventsubset_user" role. Is this correct? Is there a different way that access can be restricted to a subset of the Windows event logs while still allowing full access to the other indexes listed in the role?

Thank you.

0 Karma
1 Solution

masonmorales
Influencer

Looks like an inheritance issue. Define the new role and select the capabilities for that role manually. 🙂

View solution in original post

0 Karma

masonmorales
Influencer

Looks like an inheritance issue. Define the new role and select the capabilities for that role manually. 🙂

0 Karma

adamblock2
Path Finder

I believe that that is what was done.

0 Karma

masonmorales
Influencer

Please choose "Accept Answer" if this was your solution so that your question is marked as resolved.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...