topic Re: Read Only Executive Summary Splunk ES in Splunk Enterprise Security

Read Only Executive Summary Splunk ES

treven — Thu, 22 Feb 2024 14:55:57 GMT

Is there a way to give a user read-only access to only a specific dashboard on Splunk ES such as the Executive Summary dashboard? Any assistance would be greatly appreciated!

*Edit

Sorry we have the user role and user created but we are unable to restrict it to a single dashboard, we can specify an app such as ES but have been unsuccessful in getting a default dashboard set. When you land on ES there is the "Security Posture" "Incident Review" "App Configuration" etc settings. Would it be possible to change one of these from "Security Posture" to "Executive Summary" so that way they are just a click away from the appropriate dashboard?

Thank you!

Re: Read Only Executive Summary Splunk ES

TheLawsOfChaos — Mon, 08 Apr 2024 03:01:36 GMT

To lock a single dashboard down, you would want to create a new custom user that does not inherit the user permission.

Then you would grant that user read permissions to that single dashboard. Then the user can get to it via the link, but not even going to the app to browse for it.

If they can view ES, they can view all the dashboards (by default). You could go dashboard by dashboard, and change the custom nav to reflect it. But if you want the user to only see that one part of ES, I'd recommend the method I laid out up top.

Re: Read Only Executive Summary Splunk ES

meetmshah — Sat, 20 Apr 2024 14:41:24 GMT

+1 with @TheLawsOfChaos, It's a common practise to create a Role with "Read Only" permission. You have any further questions / issues with respect to this @treven?

Re: Read Only Executive Summary Splunk ES

treven — Fri, 03 May 2024 17:26:29 GMT

Sorry for the late response on this but this is exactly what we did created a user and role separate from the others exec_view and assigned that role read-only permissions and assigned it to specific users. Thanks for the information!