topic Re: How can I Delete Option for Alerts? in Alerting

How can I delete option for alerts?

Atchyuth_P — Thu, 17 Nov 2022 14:42:21 GMT

Hi team

I have created a user and set up capabilities however I haven't checked any delete in capabilities.

When I checked with user console able to see the delete option. Please refer to below screenshot.

Even I tried unchecking can_delete option for alert with admin access but still it is not working.

Please suggest .

Re: How can I Delete Option for Alerts?

gcusello — Thu, 17 Nov 2022 07:23:56 GMT

Hi @Atchyuth_P,

can_delete is a role to delete events, that usually isn't enabled for the other roles.

the screenshot you shared is related to alerts not to events, so there isn't any relation with can-delete role.

Each user can delete its own alerts and, if it's an admin, also delete shared alerts.

Ciao.

Giuseppe

Re: How can I Delete Option for Alerts?

Atchyuth_P — Thu, 17 Nov 2022 07:26:55 GMT

Hi @gcusello

Thank you for the response

I just want to disable the delete option for user itself.

Re: How can I Delete Option for Alerts?

gcusello — Thu, 17 Nov 2022 07:28:31 GMT

Hi @Atchyuth_P,

for my knowledge it isn't possible disable deletion of its own objects.

Ciao.

Giuseppe

Re: How can I Delete Option for Alerts?

emallinger — Thu, 17 Nov 2022 09:32:02 GMT

Hello all !

I agree with @gcusello.

Depending on the behaviour you wish to create, maybe you'll have to create the alerts and only send the results (via mail ?) to users. Or share only the result in a particular app, developped for that purpose on which users only have read access.

In that case, you are doing the job of creating and managing alerts, so it might not be the desired effect.

Happy splunking !

Ema