Solved: Which capabilities has a user used?

Moldy · ‎07-12-2024

Trying to create a search that will show which capabilities a user has used within the last year.

richgalloway · ‎07-12-2024

Capability use is not logged. Actions performed by users are logged in _audit. It would be up to you map those actions to the associated capabilities.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

Moldy · ‎07-12-2024

Thank you!

richgalloway · ‎07-12-2024

Capability use is not logged. Actions performed by users are logged in _audit. It would be up to you map those actions to the associated capabilities.

---
If this reply helps you, Karma would be appreciated.

Which capabilities has a user used?

access control

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Build the Future of Agentic AI: Join the Splunk Agentic Ops Hackathon

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

Splunk Community Badges!

Join the Conversation