What capabilities provide access to Alert Manager

[mlf]

I'm trying to grant certain roles access to the Alert Manager in 4.3.1, but it's not clear which capabilities control that access. Any ideas?

[jklumpp_splunk · Accepted solution]

The role required to access alert manager is schedule_search. Here is the snippet from the security guide describing schedule search...

Can schedule saved searches, create and update alerts, review triggered alert information, and turn on report acceleration for searches.

[sloshburch]

Meanwhile, even without those permissions, a user could access the alert manager directly. Is that a bug or something?