安全运营 -- splunk restapi 最小权限

leeezp2024-12-30 11:45

最小化权限原则，为每个功能，每个账户分配最小的权限。

只需要7个 capability:

You'll need to add certain capabilities to that user or that users's role(s).
$capability::rest_apps_management$

* Lets a user edit settings for entries and categories in the Python remote

apps handler.

* See restmap.conf.spec for more information.

$capability::rest_apps_view$

* Lets a user list various properties in the Python remote apps handler.

* See restmap.conf.spec for more info

$capability::rest_properties_get$

* Lets a user get information from the services/properties endpoint.

$capability::rest_properties_set$

* Lets a user edit the services/properties endpoint.

$capability::rest_access_server_endpoints$

* Lets a user run the 'rest' command and access 'services/server/' endpoints.

$capability::dispatch_rest_to_indexers$

* Lets a user dispatch the REST search command to indexers.

$capability::search$

* Lets a user run a search.