Splunk Enterprise Security

How can I restrict a user role access to specific Enterprise Security dashboards?

yashwanth_g_pra
Observer

Hi,

I wanted to create a user account having only access to ES-APP and within which he needs to have access to only incident review, Security Posture, Intrusion Center (present in Security domain -> Network -> Intrusion Centre) dashboards. How can this be done?

0 Karma

Grumpalot
Communicator

To accomplish this for viewing of only those Dashboards/Panels within ES you would have to modify all of the panels/views within ES and remove Read (all) rights. Then you would create a New Role that did not inherit rights from any user and grant the needed index'es/rights for the Role. Then you would select all Roles for viewing minus your new role for the panels/dashboards you did not want view access on, then for the ones that the new User/Role would get View access to you would select that Role also or reselect (all). Again this method will take some time and will take some testing to verify all still works after the change.

0 Karma

lfedak_splunk
Splunk Employee
Splunk Employee

Hey there, This documentation explains how you can create a role with specific permissions.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...