Security

The role capabilities' privileges

Jack90
Explorer

Hello,

I am managing Splunk roles. I want to adjust capabilities to roles, but unfortunately for few of them I did not find what exactly they do.  Searching did not give me results or the results were not satisfying.

If you have some extract with all capabilities and their description, please advise me what exactly following capabilities do (screenshot attached)

 

Labels (2)
Tags (2)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Jack90 ,

about user features I usually copy the same features of User role, but without inheritance to avoid that the new role has the same indexes access grants:you have to amnually enable the same features or (easier) you can clone theUser role, changing the indexes access grants.

Ciao.

Giuseppe

Jack90
Explorer

Hi Gcusello, 

thank you for quick reply.

OK I understand, but I couldn't find at the Splunk documentation the information what that capabilities does- I am not sure if "user" role should be granted with them, or only "admin" role.

BR

J

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Jack90 ,

it depends on what then new role has to do.

Anyway, surely not admin role, eventually power user.

Ciao.

Giuseppe

Jack90
Explorer

Hi,

but do you mean all 13 capabilities for power user?

I am trying to find what they actually do, to determinate if they should be user/power/admin. 

 

BR

J

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Jack90 ,

this is exactly what I meant:

  • see if there's a role to use as starting point,
  • then clone it (don't use inheritance!) c
  • and eventally modify it before saving.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...