Splunk Enterprise Security

How can I restrict a user role access to specific Enterprise Security dashboards?

yashwanth_g_pra
New Member

Hi,

I wanted to create a user account having only access to ES-APP and within which he needs to have access to only incident review, Security Posture, Intrusion Center (present in Security domain -> Network -> Intrusion Centre) dashboards. How can this be done?

0 Karma

Grumpalot
Communicator

To accomplish this for viewing of only those Dashboards/Panels within ES you would have to modify all of the panels/views within ES and remove Read (all) rights. Then you would create a New Role that did not inherit rights from any user and grant the needed index'es/rights for the Role. Then you would select all Roles for viewing minus your new role for the panels/dashboards you did not want view access on, then for the ones that the new User/Role would get View access to you would select that Role also or reselect (all). Again this method will take some time and will take some testing to verify all still works after the change.

0 Karma

lfedak_splunk
Splunk Employee
Splunk Employee

Hey there, This documentation explains how you can create a role with specific permissions.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!