Reporting

Restrict Export of Sensitive Data

IRHM73
Motivator

Hi, I wonder whether someone could help me please.

The Splunk environment I administer contains sensitive personal data which only those with the relevant clearance can view.

To add an extra line of security, my security team have asked me to remove the 'export' function so these personal details can't be downloaded, that is, until the relevant clearance is provided.

I can make the changes via the 'authorize.conf' file to the user role, setting the 'export_is_visible' in the 'Parent' role to disabled and then a 'child' role which enables the capability.

The problem I have is:

  • I want to restrict this via app, rather than a 'global ' restriction, because in addition to apps with dashboards containing sensitive data, they have access to apps with dashboards which have pure statistical data.
  • In addition, I can't change the role associated with the app, because if I change this, everyone who can just view the statistical dashboards and hence can download the data will also be affected.

Could someone tell me please is there another way to achieve this?

Many thanks and kind regards

Chris

0 Karma
1 Solution

brreeves_splunk
Splunk Employee
Splunk Employee

@IRHM73, apps are deployed to machines, not to people. I don't think you'll be able to do what you're trying to do unless you want to give access to a specific machine once clearance is given.

Global Roles are the best way to achieve this.

View solution in original post

brreeves_splunk
Splunk Employee
Splunk Employee

@IRHM73, apps are deployed to machines, not to people. I don't think you'll be able to do what you're trying to do unless you want to give access to a specific machine once clearance is given.

Global Roles are the best way to achieve this.

IRHM73
Motivator

Hi @brreeves, thank you for the confirmation.

Regards

Chris

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...