[RANGER-3258] Update default hbase audit filters to filter out unwanted audits

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.2.0
• Fix Version/s: 3.0.0, 2.2.0
• Component/s: audit
• Assignee: Mateen Mansoori
• Reporter: Abhishek Shukla
• Created: 27/Apr/21 08:43
• Updated: 12/May/21 04:02
• Resolved: 11/May/21 08:59

Description

Can we update the default HBase audit filters as follows: 

This will filter out HBase audits related to default, hbase, atlas_janus, ATLAS_ENTITY_AUDIT_EVENTS table access by hbase service user.

[
  {
    "accessResult":"DENIED",
    "isAudited":true
  },
  {
    "resources":{
      "table":{
        "values":[
          "*-ROOT-*",
          "*.META.*",
          "*_acl_*",
          "hbase:meta",
          "hbase:acl",
          "default",
          "hbase"
        ]
      }
    },
    "users":[
      "hbase"
    ],
    "isAudited":false
  },
  {
    "resources":{
      "table":{
        "values":[
          "atlas_janus",
          "ATLAS_ENTITY_AUDIT_EVENTS"
        ]
      },
      "column-family":{
        "values":[
          "*"
        ]
      },
      "column":{
        "values":[
          "*"
        ]
      }
    },
    "users":[
      "atlas",
      "hbase"
    ],
    "isAudited":false
  },
  {
    "users":[
      "hbase"
    ],
    "actions":[
      "balance"
    ],
    "isAudited":false
  }
]

cc dineshkumar-yadav

Issue Links

• is related to: RANGER-3257 Update default kafka audit filters to filter out unwanted audits
• links to: Apache RR