How to create investigations in ES 5.2.2?

[chrispounds]

Hi all,

So i have added the edit_timeline role to a user and they can create an investigation, but after you click "start investigation" they are greeted with a "failed to retrieve investigation" message. I was under the impression it was just the one user role needed for investigations, has anyone come across this before?

Many thanks,

[smoir_splunk · Accepted solution]

Per the documentation, they need the "Manage Your Investigations" capability
https://docs.splunk.com/Documentation/ES/5.2.2/Admin/Manageinvestigations
which as you correctly identify is the edit_timeline capability (not a role, but is by default included for the ess_analyst role).

If you added this capability using the ES Permissions page, it should be working. If you added the capability using authorize.conf, some necessary ACLs might be missing. Check the ES Permissions page, and/or verify that the users have the ess_analyst role (unless you are using custom roles).

[chrispounds]

Thank you smoir 🙂

[chrispounds]

So we currently have custom roles for our ES system.

sec_user -> inherits normal user with added capabilities (edit_timeline).

But when i view sec_user's "imported capabilities", edit_timeline doesn't appear, so perhaps it isn't inheriting the capability correctly? Although this wouldn't explain why the user can create the investigation, but receives an error when trying to view.

I have checked the investigation as admin and can confirm it's working as expected, so must be a permission hick up somewhere!

[pschulz_splunk]

when the user is missing edit_timeline capability you should see: 'You do not have permission to access investigations.'
There is probably something else going on, you should check if there are failing network requests.

[smoir_splunk]

Yeah, that does sound odd. I'd suggest using the ES permissions page to manually add the capability to the sec_user role, or to re-add it to the "normal user" account and see if that fixes the issue.