splunk-security
starsforks
How to install splunk-security?
grandcamel/splunk-assistant-skills/splunk-security
$npx -y skills add grandcamel/Splunk-Assistant-Skills --skill splunk-securityToken management, RBAC, and ACL verification for Splunk.
SKILL.md
| 1 | # splunk-security |
| 2 | |
| 3 | Token management, RBAC, and ACL verification for Splunk. |
| 4 | |
| 5 | ## Purpose |
| 6 | |
| 7 | Manage JWT tokens, check permissions, and configure ACLs on knowledge objects. |
| 8 | |
| 9 | ## Risk Levels |
| 10 | |
| 11 | | Operation | Risk | Notes | |
| 12 | |-----------|------|-------| |
| 13 | | Get current user | - | Read-only | |
| 14 | | List users/roles | - | Read-only | |
| 15 | | List tokens | - | Read-only | |
| 16 | | Get capabilities | - | Read-only | |
| 17 | | Check permission | - | Read-only | |
| 18 | | Get ACL | - | Read-only | |
| 19 | | Create token | ⚠️ | Security credential created | |
| 20 | | Delete token | ⚠️⚠️ | **Breaks dependent integrations** | |
| 21 | | Modify ACL | ⚠️⚠️ | Changes access permissions | |
| 22 | |
| 23 | ## Triggers |
| 24 | |
| 25 | - "token", "permission", "ACL" |
| 26 | - "security", "RBAC", "role" |
| 27 | - "access", "capabilities" |
| 28 | |
| 29 | ## CLI Commands |
| 30 | |
| 31 | | Command | Description | |
| 32 | |---------|-------------| |
| 33 | | `security whoami` | Get current user info | |
| 34 | | `security list-users` | List all users | |
| 35 | | `security list-roles` | List all roles | |
| 36 | | `security list-tokens` | List auth tokens | |
| 37 | | `security create-token` | Create auth token | |
| 38 | | `security delete-token` | Delete auth token | |
| 39 | | `security capabilities` | Get user capabilities | |
| 40 | | `security check` | Check if user has capability | |
| 41 | | `security acl` | Get ACL for resource | |
| 42 | |
| 43 | ## Options |
| 44 | |
| 45 | | Option | Commands | Description | |
| 46 | |--------|----------|-------------| |
| 47 | | `-o`, `--output` | whoami, list-users, list-roles, list-tokens, capabilities, acl | Output format (text, json) | |
| 48 | | `-n`, `--name` | create-token | Token name (required) | |
| 49 | | `--audience` | create-token | Token audience (optional) | |
| 50 | | `--expires` | create-token | Expiration time in seconds (optional) | |
| 51 | |
| 52 | ## Examples |
| 53 | |
| 54 | ```bash |
| 55 | # Get current user info (with output format) |
| 56 | splunk-as security whoami |
| 57 | splunk-as security whoami -o json |
| 58 | |
| 59 | # List users |
| 60 | splunk-as security list-users |
| 61 | splunk-as security list-users -o json |
| 62 | |
| 63 | # List roles |
| 64 | splunk-as security list-roles |
| 65 | splunk-as security list-roles -o json |
| 66 | |
| 67 | # List tokens |
| 68 | splunk-as security list-tokens |
| 69 | splunk-as security list-tokens -o json |
| 70 | |
| 71 | # Create token (--name required, --audience and --expires optional) |
| 72 | splunk-as security create-token -n "my-app-token" |
| 73 | splunk-as security create-token -n "my-app-token" --audience "my-app" --expires 2592000 |
| 74 | |
| 75 | # Delete token |
| 76 | splunk-as security delete-token token_123 |
| 77 | |
| 78 | # Get capabilities (current user) |
| 79 | splunk-as security capabilities |
| 80 | splunk-as security capabilities -o json |
| 81 | |
| 82 | # Check if user has a specific capability (positional argument) |
| 83 | splunk-as security check search |
| 84 | |
| 85 | # Get ACL (full REST path starting with /) |
| 86 | splunk-as security acl /servicesNS/nobody/search/saved/searches/MySearch |
| 87 | splunk-as security acl /servicesNS/nobody/search/saved/searches/MySearch -o json |
| 88 | ``` |
| 89 | |
| 90 | ## API Endpoints |
| 91 | |
| 92 | - `GET/POST/DELETE /services/authorization/tokens` - Tokens |
| 93 | - `GET/POST /services/data/transforms/lookups/{name}/acl` - ACL |
People who liked this also viewed
6 picksType
- entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026
- azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026
- azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026
- better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 2026
- firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 2026
- audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 2026
