https://community.splunk.com/t5/Splunk-Enterprise-Security/Why-does-the-Notable-Incident-Review-Status-dropdown-have-quot/m-p/610140#M10992 <P>We are in SplunkCloud with ES 7.0.0</P> <P>As a user with the sc_admin or ess_admin role when selecting an incident to edit, the drop-down for "Status" gives no matches. All other drop-downs give options as expected.<BR /><BR />We've tried enable/disable all statuses, creating new statuses, adding/removing transitions roles for ALL statuses, granting permissions to edit_reviewstatus for additional roles, granting write permissions to kvstore reviewstatuses_lookup, and several other things.</P> <P>Is there a key thing we are missing to be able to change status on incidents with the ess_admin user?</P> Fri, 19 Aug 2022 16:58:03 GMT cjacklum 2022-08-19T16:58:03Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Why-does-the-Notable-Incident-Review-Status-dropdown-have-quot/m-p/610140#M10992 <P>We are in SplunkCloud with ES 7.0.0</P> <P>As a user with the sc_admin or ess_admin role when selecting an incident to edit, the drop-down for "Status" gives no matches. All other drop-downs give options as expected.<BR /><BR />We've tried enable/disable all statuses, creating new statuses, adding/removing transitions roles for ALL statuses, granting permissions to edit_reviewstatus for additional roles, granting write permissions to kvstore reviewstatuses_lookup, and several other things.</P> <P>Is there a key thing we are missing to be able to change status on incidents with the ess_admin user?</P> Fri, 19 Aug 2022 16:58:03 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Why-does-the-Notable-Incident-Review-Status-dropdown-have-quot/m-p/610140#M10992 cjacklum 2022-08-19T16:58:03Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Why-does-the-Notable-Incident-Review-Status-dropdown-have-quot/m-p/612111#M11018 <P>This turned out to be the sharing permissions on Enterprise Security App was set to "App".<BR />The fix was to change this to "Global".</P> Tue, 06 Sep 2022 14:53:03 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Why-does-the-Notable-Incident-Review-Status-dropdown-have-quot/m-p/612111#M11018 cjacklum 2022-09-06T14:53:03Z