Splunk Enterprise Security

How can I restrict a user role access to specific Enterprise Security dashboards?

yashwanth_g_pra
Observer

Hi,

I wanted to create a user account having only access to ES-APP and within which he needs to have access to only incident review, Security Posture, Intrusion Center (present in Security domain -> Network -> Intrusion Centre) dashboards. How can this be done?

0 Karma

Grumpalot
Communicator

To accomplish this for viewing of only those Dashboards/Panels within ES you would have to modify all of the panels/views within ES and remove Read (all) rights. Then you would create a New Role that did not inherit rights from any user and grant the needed index'es/rights for the Role. Then you would select all Roles for viewing minus your new role for the panels/dashboards you did not want view access on, then for the ones that the new User/Role would get View access to you would select that Role also or reselect (all). Again this method will take some time and will take some testing to verify all still works after the change.

0 Karma

lfedak_splunk
Splunk Employee
Splunk Employee

Hey there, This documentation explains how you can create a role with specific permissions.

0 Karma
Get Updates on the Splunk Community!

Splunk App for Anomaly Detection End of Life Announcment

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...