Splunk Enterprise Security

Feature request: Splunk ES investigation collaborator groups

japo86
New Member

I request that there be the ability to create groups of users in enterprise security so that when you need to add them to an investigation you dont have go to through and select your whole team individually, instead you can have group that have those people in them, like group IR and group SOC. If you have team of more than 3 people it gets old having to add them all individually.

I would also request a notes section where you can place notes on the investigation for all collaborators to see.

Labels (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

That's what https://ideas.splunk.com is for.

0 Karma
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.


Introducing Unified TDIR with the New Enterprise Security 8.2

Read the blog
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...