https://community.splunk.com/t5/Security/Unknown-splunk-cloud-role/m-p/467802#M10876 <P>When I run a report of roles that have been modified in our splunk cloud instance I see these entries</P> <PRE><CODE>Date Time user action info role_name 04-06-20 16:50:18 _ops_admin edit_user granted _ops_admin 04-06-20 16:50:15 _ops_admin edit_user granted _ops_admin 04-06-20 16:49:52 _ops_admin edit_user granted _ops_admin 04-06-20 16:44:06 _ops_admin edit_user granted _ops_admin 04-06-20 16:44:03 _ops_admin edit_user granted _ops_admin </CODE></PRE> <P>We dont have that user or role name defined in our instance. Anyone have an idea of what this is and if I should be concerned?</P> Sun, 07 Jun 2020 17:48:09 GMT randy_moore 2020-06-07T17:48:09Z https://community.splunk.com/t5/Security/Unknown-splunk-cloud-role/m-p/467802#M10876 <P>When I run a report of roles that have been modified in our splunk cloud instance I see these entries</P> <PRE><CODE>Date Time user action info role_name 04-06-20 16:50:18 _ops_admin edit_user granted _ops_admin 04-06-20 16:50:15 _ops_admin edit_user granted _ops_admin 04-06-20 16:49:52 _ops_admin edit_user granted _ops_admin 04-06-20 16:44:06 _ops_admin edit_user granted _ops_admin 04-06-20 16:44:03 _ops_admin edit_user granted _ops_admin </CODE></PRE> <P>We dont have that user or role name defined in our instance. Anyone have an idea of what this is and if I should be concerned?</P> Sun, 07 Jun 2020 17:48:09 GMT https://community.splunk.com/t5/Security/Unknown-splunk-cloud-role/m-p/467802#M10876 randy_moore 2020-06-07T17:48:09Z https://community.splunk.com/t5/Security/Unknown-splunk-cloud-role/m-p/467803#M10877 <P>Values beginning with "_" are often reserved by Splunk. Perhaps this is a user/role Splunk uses to manage your Cloud instances.</P> Tue, 07 Apr 2020 14:47:43 GMT https://community.splunk.com/t5/Security/Unknown-splunk-cloud-role/m-p/467803#M10877 richgalloway 2020-04-07T14:47:43Z