Solved: Which capabilities has a user used?

Moldy · ‎07-12-2024

Trying to create a search that will show which capabilities a user has used within the last year.

richgalloway · ‎07-12-2024

Capability use is not logged. Actions performed by users are logged in _audit. It would be up to you map those actions to the associated capabilities.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

Moldy · ‎07-12-2024

Thank you!

richgalloway · ‎07-12-2024

Capability use is not logged. Actions performed by users are logged in _audit. It would be up to you map those actions to the associated capabilities.

---
If this reply helps you, Karma would be appreciated.

Which capabilities has a user used?

access control

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Your Feedback. Our Roadmap. Visit the PX Feedback Booth at .conf26

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas

Join the Conversation