Splunk Enterprise Security

Splunk Enterprise Security: What role or capability is needed to enable the investigations functionality for users?

szabados
Communicator

Some users reported that the investigations functionality is not available for them in the Enterprise Security app. What role/capability should I assign to them?

0 Karma

smoir_splunk
Splunk Employee
Splunk Employee

To create investigations, a user must be an ess_admin or have the edit_timeline capability. See
http://docs.splunk.com/Documentation/ES/4.1.1/Install/ConfigureUsersRoles to see how to add the capability.

If they can see investigations but can't view specific investigations, they would need to be added as a collaborator on that investigation.

0 Karma

tskinner_splunk
Splunk Employee
Splunk Employee

should not be assigning ess_admin role to users. It is a container role which is used just to give additional capabilities and inherited by admin (or sc_admin in splunk cloud) to be used for ES installation and upgrade tasks. It contains no ACLs

https://docs.splunk.com/Documentation/ES/latest/Install/ConfigureUsersRoles

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...