Splunk Enterprise Security

Help with Splunk ES Investigations Collaborators

mbouchersops
Engager

Hello,

We are using Splunk Enterprise Security and I was just wondering if there is any way to add multiple collaborators at once to an investigation or to make it visible to the analyst to see the investigation under the Related Investigations field in Incident Review tab? It would be nice if they could see the investigation notes also.

I have already tried to check the box for Manage All Investigations under the Permissions in the Configuration section and still, it is not working.

If someone could help I would really appreciate it.

Thank You & Regards

jawaharas
Motivator

Q1: Add multiple collaborators at once to an investigation
A1: As far I know, you can multiple collaborators to an investigation one by one. NOT at once.

Q2: make investigation visible to the analyst to see the investigation under the Related Investigations field in Incident Review tab?
A2: Once collaborators added to an investigation, they can notice the investigation under the 'Related Investigation' field in the 'Incident Review' tab.

Q3: It would be nice if they could see the investigation notes also.
A3: User has to click the 'investigation' (which usually opens in new tab/window) to see the investigation notes.

0 Karma
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...