Overview

The Cribl Decrypt Add-On for Splunk provides a custom command - cribldecrypt - that will decrypt data at search time encrypted via Cribl's Encryption of Data in Motion.

Usage

In any search page, use the cribldecrypt command to decrypt data encrypted with Cribl Stream. Users will need to have the list_storage_passwords capability to access the keys (default for admin role).

The command has no options - it will decrypt any data encrypted by Cribl Stream for which keys have been uploaded, including _raw and fields in the event.

index=<index_name> | cribldecrypt

Note: Since this command requires access to the Search Head's REST interface, it is technically a dataset processing command, which means that it should appear as late as possible in the search string.

Configuration

Cribl Stream:
- Export key bundle from Cribl Stream by going to Group Settings ->Security -> Encryption Keys and clicking "Get Key Bundle"
- Repeat for each Worker Group that is sending encrypted data to Splunk

Cribl Decrypt Add-On for Splunk:
- Go to the Key Management page in the Cribl Decrypt Add-On and upload the key bundle. Users will need admin_all_objects capability to upload the key bundle (default for admin role).
- Refreshing the page will show the uploaded keys in the list. Keys are stored in Splunk Secret Storage.
- To delete a key, enter the Key ID in the "Delete a key" sections field and click Delete.

Cribl Decrypt Add-On for Splunk

0