https://community.splunk.com/t5/Splunk-Enterprise-Security/Custom-Role-Inheritance-Is-Not-Working-In-ES-App-After-Upgrade/m-p/434560#M5725 <P>Customer have created SOC l1 and SOCl 2 custom roles, SOC l1 has the inherited role ES analyst, ES user and user. </P> <P>SOC l2 inherited role SOC l1 and few additional capabilities. There was no issue with 4.7.X version. SOCl2 person can edit the notable event and investigated all logs etc. After upgrade SOCl2 started facing issue, user unable to edit the notable event. </P> <P>In customer test environment once customer remove our custom role from SOCl2 and add ES analyst, ES user and user role then it start working. What customer see custom inheritance of role is not working. Can assist to understand what is the reason behind this?</P> Fri, 08 Mar 2019 07:20:46 GMT rsantoso_splunk 2019-03-08T07:20:46Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Custom-Role-Inheritance-Is-Not-Working-In-ES-App-After-Upgrade/m-p/434560#M5725 <P>Customer have created SOC l1 and SOCl 2 custom roles, SOC l1 has the inherited role ES analyst, ES user and user. </P> <P>SOC l2 inherited role SOC l1 and few additional capabilities. There was no issue with 4.7.X version. SOCl2 person can edit the notable event and investigated all logs etc. After upgrade SOCl2 started facing issue, user unable to edit the notable event. </P> <P>In customer test environment once customer remove our custom role from SOCl2 and add ES analyst, ES user and user role then it start working. What customer see custom inheritance of role is not working. Can assist to understand what is the reason behind this?</P> Fri, 08 Mar 2019 07:20:46 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Custom-Role-Inheritance-Is-Not-Working-In-ES-App-After-Upgrade/m-p/434560#M5725 rsantoso_splunk 2019-03-08T07:20:46Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Custom-Role-Inheritance-Is-Not-Working-In-ES-App-After-Upgrade/m-p/434561#M5726 <P>It is a bug SOLNESS-17285 with the ES version 5.1.1, where the cannot handle multi-level inheritance.</P> <P>This bug target to be fix in next release 5.3. </P> <P>The workaround for the customer will be that SOC2 inherits from es-analyst directly rather than from SOC1.</P> Fri, 08 Mar 2019 07:21:18 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Custom-Role-Inheritance-Is-Not-Working-In-ES-App-After-Upgrade/m-p/434561#M5726 rsantoso_splunk 2019-03-08T07:21:18Z