Cribl Security & Access Control Flashcards

Which Cribl feature allows administrators to audit which users made configuration changes and when?

Answer: Audit Logs

Cribl's Audit Logs record user actions such as configuration changes, logins, and deletions with timestamps for accountability.

What is the recommended practice for managing Cribl API tokens securely?

Answer: Store tokens in a secrets manager and rotate them regularly

API tokens should be stored in a secrets manager and rotated regularly to minimize the risk of unauthorized access.

How can Cribl Stream be configured to prevent unauthorized access to the Leader node's web UI?

Answer: Enabling authentication and restricting network access with firewall rules

Combining authentication enforcement with network-level firewall restrictions to the Leader's management port prevents unauthorized UI access.

Which Cribl permission scope allows a user to view pipeline configurations but not modify them?

Answer: read

The 'read' permission scope in Cribl grants view-only access to configurations without the ability to make changes.

When configuring Cribl to forward data to a SIEM, which security practice ensures the destination credentials are not exposed in the config?

Answer: Using Cribl's Secrets Store to reference credentials by name

Cribl's Secrets Store allows credentials to be referenced by name in destination configurations, keeping them out of plaintext config files.

What happens in Cribl when a user without sufficient RBAC permissions attempts to commit a configuration change?

Answer: The action is blocked and an error is returned

Cribl enforces RBAC at the API and UI level, blocking unauthorized actions and returning an error to the user.