Splunk Enterprise Security

How to create investigations in ES 5.2.2?

chrispounds
Explorer

Hi all,

So i have added the edit_timeline role to a user and they can create an investigation, but after you click "start investigation" they are greeted with a "failed to retrieve investigation" message. I was under the impression it was just the one user role needed for investigations, has anyone come across this before?

Many thanks,

0 Karma
1 Solution

smoir_splunk
Splunk Employee
Splunk Employee

Per the documentation, they need the "Manage Your Investigations" capability
https://docs.splunk.com/Documentation/ES/5.2.2/Admin/Manageinvestigations
which as you correctly identify is the edit_timeline capability (not a role, but is by default included for the ess_analyst role).

If you added this capability using the ES Permissions page, it should be working. If you added the capability using authorize.conf, some necessary ACLs might be missing. Check the ES Permissions page, and/or verify that the users have the ess_analyst role (unless you are using custom roles).

View solution in original post

smoir_splunk
Splunk Employee
Splunk Employee

Per the documentation, they need the "Manage Your Investigations" capability
https://docs.splunk.com/Documentation/ES/5.2.2/Admin/Manageinvestigations
which as you correctly identify is the edit_timeline capability (not a role, but is by default included for the ess_analyst role).

If you added this capability using the ES Permissions page, it should be working. If you added the capability using authorize.conf, some necessary ACLs might be missing. Check the ES Permissions page, and/or verify that the users have the ess_analyst role (unless you are using custom roles).

chrispounds
Explorer

Thank you smoir 🙂

0 Karma

chrispounds
Explorer

So we currently have custom roles for our ES system.

sec_user -> inherits normal user with added capabilities (edit_timeline).

But when i view sec_user's "imported capabilities", edit_timeline doesn't appear, so perhaps it isn't inheriting the capability correctly? Although this wouldn't explain why the user can create the investigation, but receives an error when trying to view.

I have checked the investigation as admin and can confirm it's working as expected, so must be a permission hick up somewhere!

0 Karma

pschulz_splunk
Splunk Employee
Splunk Employee

when the user is missing edit_timeline capability you should see: 'You do not have permission to access investigations.'
There is probably something else going on, you should check if there are failing network requests.

0 Karma

smoir_splunk
Splunk Employee
Splunk Employee

Yeah, that does sound odd. I'd suggest using the ES permissions page to manually add the capability to the sec_user role, or to re-add it to the "normal user" account and see if that fixes the issue.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...