Security
Highlighted

Unknown splunk cloud role

Path Finder

When I run a report of roles that have been modified in our splunk cloud instance I see these entries

Date         Time     user       action    info     role_name
04-06-20    16:50:18    _ops_admin  edit_user   granted _ops_admin
04-06-20    16:50:15    _ops_admin  edit_user   granted _ops_admin
04-06-20    16:49:52    _ops_admin  edit_user   granted _ops_admin
04-06-20    16:44:06    _ops_admin  edit_user   granted _ops_admin
04-06-20    16:44:03    _ops_admin  edit_user   granted _ops_admin

We dont have that user or role name defined in our instance. Anyone have an idea of what this is and if I should be concerned?

Labels (1)
Tags (2)
0 Karma
Highlighted

Re: Unknown splunk cloud role

SplunkTrust
SplunkTrust

Values beginning with "_" are often reserved by Splunk. Perhaps this is a user/role Splunk uses to manage your Cloud instances.

---
If this reply helps you, an upvote would be appreciated.
0 Karma