https://community.splunk.com/t5/Splunk-Enterprise-Security/advhunt-custom-Command/m-p/712028#M12366 <P>I think this "admin_all_objects" privilege is needed by the app to access the client secret stored in the app, which is used to authenticate the advanced hunting requests.</P><P>There is another app (<A href="https://splunkbase.splunk.com/app/6463" target="_blank">https://splunkbase.splunk.com/app/6463</A>) which appears to do the same thing albeit with a differently named command "defkqlg". It says in the Details tab that you can use the "edit_storage_passwords" capability instead of "admin_all_objects" if your Splunk Enterprise version is later than 9.1.0.</P><P>It might also be possible to use edit_storage_passwords privilege instead on the MS Defender Advanced Hunting app, but it would need to be tested.</P> Wed, 19 Feb 2025 19:15:07 GMT marnall 2025-02-19T19:15:07Z https://community.splunk.com/t5/Splunk-Enterprise-Security/advhunt-custom-Command/m-p/712026#M12365 <P>Our Security partners at work recently determined that their analyst need the ability to run the custom command:&nbsp;<BR /><BR />advhunt (<SPAN>TA_ms_advanced_hunting)</SPAN><BR /><BR />The custom command indicates:</P><UL><LI><P>To use this app, users need following privileges.</P><UL><LI>list_storage_passwords</LI><LI>admin_all_objects</LI></UL></LI></UL><P>We do not want to give all Security users the ability to admin_all_objects. What other options do we have?&nbsp;<BR /><BR /></P> Wed, 19 Feb 2025 18:37:15 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/advhunt-custom-Command/m-p/712026#M12365 Morty2 2025-02-19T18:37:15Z https://community.splunk.com/t5/Splunk-Enterprise-Security/advhunt-custom-Command/m-p/712028#M12366 <P>I think this "admin_all_objects" privilege is needed by the app to access the client secret stored in the app, which is used to authenticate the advanced hunting requests.</P><P>There is another app (<A href="https://splunkbase.splunk.com/app/6463" target="_blank">https://splunkbase.splunk.com/app/6463</A>) which appears to do the same thing albeit with a differently named command "defkqlg". It says in the Details tab that you can use the "edit_storage_passwords" capability instead of "admin_all_objects" if your Splunk Enterprise version is later than 9.1.0.</P><P>It might also be possible to use edit_storage_passwords privilege instead on the MS Defender Advanced Hunting app, but it would need to be tested.</P> Wed, 19 Feb 2025 19:15:07 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/advhunt-custom-Command/m-p/712028#M12366 marnall 2025-02-19T19:15:07Z