Security

restrict users from deleting other users knowledge objects

kranthimutyala
Path Finder

Hi Everyone,

I need some help in restrict users from deleting other users knowledge objects.Recently one of the user has deleted the alerts which belongs to  other team.We need to restrict them in deleting other KO's and they have only the capability of deleting their own and share their KO's globally. All this is related to search and reporting app.

Below is the existing config which we are using currently.Kindly advise me on tweaking the setting to achieve the above mentioned restrictions.

 

[role_vpn]
accelerate_search = enabled
cumulativeRTSrchJobsQuota = 50
edit_search_schedule_window = enabled
export_results_is_visible = enabled
get_metadata = enabled
get_typeahead = enabled
pattern_detect = enabled
rest_properties_get = enabled
rtSrchJobsQuota = 5
rtsearch = enabled
schedule_search = enabled
search = enabled
srchDiskQuota = 200
srchIndexesAllowed = vpn
srchIndexesDefault = vpn
srchJobsQuota = 20
srchMaxTime = 0

And the permission for search and reporting are as follows.

[]
access = read : [ * ], write : [ * ]
export = none

Thank you.

 

 

Labels (4)
0 Karma

thambisetty
SplunkTrust
SplunkTrust

user from the above role role_vpn deleted KO's of other user?

————————————
If this helps, give a like below.
0 Karma

kranthimutyala
Path Finder

@thambisetty  yes all have write access to search app , we gave write access to enable sharing option , but some users without knowledge are deleting others KOs(including other KOs created by other roles).

The config which I shared is same for all the roles.Any help is highly appreciated.Thanks

0 Karma

isoutamo
SplunkTrust
SplunkTrust
I propose that you will add separate apps for those groups and then create roles per app. Then all write should be done via those. Personally I don’t like the idea that all users can share KOs globally. Usually this generates more issues than solves those especially when you are using those separate apps and sharing KOs only in app level.
r. Ismo
0 Karma

kranthimutyala
Path Finder

@isoutamo  Thanks for the reply.Can we update the existing roles where users get the capability to share but not delete the objects of others within search app,  rather than creating a lot of new apps for each role

 

@niketn 

Tags (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust
I don’t think so. If user has the write/modify capability then they can also delete.
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...