Security

Cannot suppress notable event

rroberts
Splunk Employee
Splunk Employee

Working in the esanalyst role I cannot suppress a notable event in ES 3.0.
Is this working as designed? If so, what capability do I need to give the role?

Tags (1)
0 Karma
1 Solution

rroberts
Splunk Employee
Splunk Employee

To enable notable event suppression for esanalyst role add edit-suppressions to the role and make sure they have write permission in the SA-ThreatIntelligence app.

View solution in original post

rroberts
Splunk Employee
Splunk Employee

To enable notable event suppression for esanalyst role add edit-suppressions to the role and make sure they have write permission in the SA-ThreatIntelligence app.

View solution in original post

AndySplunks
Communicator

I gave my ess_analysts the edit-suppressions role. They don't have write access to SA-ThreatIntelligence though and aren't experiencing any problems yet.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!