Working in the esanalyst role I cannot suppress a notable event in ES 3.0.
Is this working as designed? If so, what capability do I need to give the role?
To enable notable event suppression for esanalyst role add edit-suppressions to the role and make sure they have write permission in the SA-ThreatIntelligence app.
To enable notable event suppression for esanalyst role add edit-suppressions to the role and make sure they have write permission in the SA-ThreatIntelligence app.
I gave my ess_analysts the edit-suppressions role. They don't have write access to SA-ThreatIntelligence though and aren't experiencing any problems yet.
