https://community.splunk.com/t5/Splunk-Enterprise-Security/Enterprise-Security-Suite-Incident-Review-How-do-you-edit-the/m-p/199169#M1028 <P>I belive your users need to be member of the "Security Analyst" (dont remmember the "correct" name) role</P> <P>Read the docs, it is described in there how to setup / configure it correctly. <span class="lia-unicode-emoji" title=":winking_face:">😉</span></P> Tue, 17 Jun 2014 11:02:29 GMT lmyrefelt 2014-06-17T11:02:29Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Enterprise-Security-Suite-Incident-Review-How-do-you-edit-the/m-p/199167#M1026 <P>How do you control who is in the drop down list of owners, so you can assign a ticket to someone else? It seems to have picked a bunch of random people and not the two people I need in there.</P> Fri, 30 Sep 2022 14:35:34 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Enterprise-Security-Suite-Incident-Review-How-do-you-edit-the/m-p/199167#M1026 vaudajordan 2022-09-30T14:35:34Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Enterprise-Security-Suite-Incident-Review-How-do-you-edit-the/m-p/199168#M1027 <P>Make sure that the users you want to assign notable events to have the "can_own_notable_events" capability. Once you add that, you should see them in the list of people you can assign notable events to in a few minutes.</P> Mon, 28 Sep 2020 16:52:09 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Enterprise-Security-Suite-Incident-Review-How-do-you-edit-the/m-p/199168#M1027 LukeMurphey 2020-09-28T16:52:09Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Enterprise-Security-Suite-Incident-Review-How-do-you-edit-the/m-p/199169#M1028 <P>I belive your users need to be member of the "Security Analyst" (dont remmember the "correct" name) role</P> <P>Read the docs, it is described in there how to setup / configure it correctly. <span class="lia-unicode-emoji" title=":winking_face:">😉</span></P> Tue, 17 Jun 2014 11:02:29 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Enterprise-Security-Suite-Incident-Review-How-do-you-edit-the/m-p/199169#M1028 lmyrefelt 2014-06-17T11:02:29Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Enterprise-Security-Suite-Incident-Review-How-do-you-edit-the/m-p/615381#M11080 <P>The problem with this solution is that all Admins have the capability "<SPAN>can_own_notable_events</SPAN>" and they appear in the list among SOC analysts.</P><P>The woraround I found is to disable "es_notable_events" in Lookup definitions page, and edit the kv-store lookup "<SPAN>notable_owners</SPAN>" by the app "<SPAN>Splunk App for Lookup File Editing".</SPAN></P><P><SPAN>The impact of this solution is that newly added SOC members need to be added manually to the "notable_owners" lookup.</SPAN></P><P>&nbsp;</P> Fri, 30 Sep 2022 12:32:22 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Enterprise-Security-Suite-Incident-Review-How-do-you-edit-the/m-p/615381#M11080 aakwah 2022-09-30T12:32:22Z