Splunk Enterprise Security -> Incident Review -> What capability is required to "Edit Selected"

[pkeller]

In the Incident Review panel, we select a Notable Event, click on Edit Selected and a form pops up.
I chose the first dropdown, selected "ACKIN" and clicked on Save and was returned:

Unable to change 1 events: transition from New to ACKIN is not allowed (1 event)

The user has both "edit_reviewstatuses" and "edit_notable_events" yet the error is returned.

[lakshman239 · Accepted solution]

I believe you are using custom notable and/or investigation status and the transition status seems to have not been defined. You can review and update them or create new transitions using GUI https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Investigationstatus [ You may need ess_admin or an equivalent role to define]

[pkeller]

Thank you very much. I'll look into this.