Security

How to restrict access to knowledge objects for users?

sbarinov
Path Finder

Hello all,

Is it possible in Splunk to restrict user of accessing the "Knowledge" settings?
I want to disable certain roles to create event types.

Thank you.

0 Karma
1 Solution

CarsonZa
Contributor

i dont believe its possible to stop the user from creating their own private knowledge object however, you can restrict ability to write to the search app by disabling write permissions in the app.

manage apps>search & reporting>permissions> untick write for roles as desired.

again the user can save ko to use themselves but can not save them to the app without facing an error message.

View solution in original post

CarsonZa
Contributor

i dont believe its possible to stop the user from creating their own private knowledge object however, you can restrict ability to write to the search app by disabling write permissions in the app.

manage apps>search & reporting>permissions> untick write for roles as desired.

again the user can save ko to use themselves but can not save them to the app without facing an error message.

sbarinov
Path Finder

Thanks, looks like this is what I need.

0 Karma

somesoni2
Revered Legend

You can find the list of capabilities that you can turn on/off for a role, here:
http://docs.splunk.com/Documentation/Splunk/7.1.2/Security/Rolesandcapabilities#List_of_capabilities

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...