Access and Authorization in Splunk

00:00

bloom. Welcome back to the Splunk Enterprise Certified Administrator course on Cyber. This is Lesson six point to where we'll be discussing the access and authorization in Splunk so previous less. When we talked about what authentication options there are now, we're gonna get mawr into how privileges are granted.

00:20

So the learning objectives for this course will be to cover the type of access control that's used in ***,

00:27

explain the process for getting users on board it into Splunk, talk about Splunk bass roles and then also discussed how you go about creating your own custom roles and Splunk. Why are we learning this?

00:39

Now that we know what authentication options are available? That's great, but we we need one more piece of the puzzle before will be able to actually use our users. So when Splunk,

00:50

it's great to have a user account, but it also needs to be assigned the relevant permissions. Otherwise, you won't be able to use the account yet, so this is, ah, essential next step, getting your users ready to log into their accounts. So

01:07

what type of access is used in Splunk?

01:11

It's what's referred to his role based access control or are back, which basically means that instead of a user having their permissions defined on an individual basis or an object having three, the

01:23

the permissions defined at that level. Instead, users are assigned to roles, and the roles are what defines what permissions that that user has. So an important note with Splunk is if a user does not belong to a role, they will not be able to log in. So it is essential

01:44

that you set this up beforehand.

01:48

So when you bring users in this splitting, this is what the general process is gonna look like. First, you're going to create roles. And that's important because while Splunk does ship with bass roles, you're not supposed to use those. You should really use them as a baseline and develop your own roles in case future updates or anything.

02:07

Change the role fundamentally or anything like that.

02:12

And then, once the role is created, you should assign the relevant capabilities to that role and then also specify which indexes people in that role are supposed to be able to see. And then you can create or integrate user's through another system, using one of the

02:30

authentication options that we discussed in the previous video

02:34

and then either assigned the user were, in the case of active directory, map the users role to a role in Splunk.

02:45

So the splint default rolls consists of admin power user but just called Power User and then can delete. So these are the bass roles. Like I said before, you shouldn't really use these. You should use them as a baseline and then model your own roles after this important to note

03:04

the candle eat roll. So the admin admin basically has permissions to do everything except for delete data via the Splunk

03:13

Delete command that's reserved for just the can delete rule. And you should keep it that way. Ideally, no one should really be doing that is when you do that in schooling, search, whatever. Basically, whatever data you bring back from your search, you can pipe that into a delete command, and then that will make it impossible to

03:31

return those events again in a search. It doesn't actually delete them from disk,

03:38

but it does make them virtually inaccessible.

03:43

So has we've mentioned a couple times. Don't use the default rolls. Instead, you should create custom roles, so you can create a new role pretty easily via Splunk Web simply 02 settings users roles at new. And then, if you want to

04:01

streamline or fast track making your role of baseball of another one, you can select a role to inherit from,

04:09

and so that could make this process a little quicker.

04:12

And then, as I mentioned in the previous slide, make sure that you're restricting access to the delete by keyword capability. I know I mentioned capabilities a couple times previously in the slide just to make sure that I'm being clear. So

04:26

individual permissions or abilities that AH role will have in Splunk are referred to his capabilities,

04:33

and you'll have to get kind of familiar with those and

04:38

be able to determine which ones are appropriate for given role. *** does have documentation that goes over each capability that's available, what it does and which users have it by default. I will link that in the resource is tab. So if just just keep that in mind

04:57

when you're considering fools.

05:00

So in summary

05:00

during this lesson, we discussed how access works in Splunk and that it uses role based access control how to add users to a role, since that is essential and you will not be able to log in unless you belong to a role. We also discussed the four Splunk default rolls admin power user and can delete.

05:20

Then we also went through

05:23

How can you create your own custom roles? And we'll explore both of these concepts in more depth in a lab. So, uh, if you felt like that was kind of a light overview, don't worry. We will jump into this a little bit more thoroughly during a lab, so we'll see you