How to restrict index access to a subset of events, while allowing full access to other indexes?

[adamblock2]

I am interested in allowing a limited number of network users to access specific Windows events. The network users are currently members of a "company_user_network" role. I would like to create a second role for the purpose of assigning access to the subset of Windows events.

Role: company_wineventsubset_user
restrict search terms: eventtype=wineventsubset
inherited roles:

indexes searched by default: All non-internal indexes
restrict access to index: wineventlog

Role: company_user_network
inherited roles: user
indexes searched by default: firewall, network, vpn, web
restrict access to index: firewall, network, vpn, web

User: user_test
selected roles: company_user_network, company_wineventsubset_user

I have attempted using the above configurations. Unfortunately, the "restrict search terms: eventtype=wineventsubset" is being applied to both roles, not just the "company_wineventsubset_user" role. Is this correct? Is there a different way that access can be restricted to a subset of the Windows event logs while still allowing full access to the other indexes listed in the role?

Thank you.

[masonmorales · Accepted solution]

Looks like an inheritance issue. Define the new role and select the capabilities for that role manually. 🙂

[adamblock2]

I believe that that is what was done.

[masonmorales]

Please choose "Accept Answer" if this was your solution so that your question is marked as resolved.