Splunk Enterprise Security
Highlighted

Splunk for Enterprise Security: Is it possible to allow non-admin users to edit and save Assets and identities lists manually?

Explorer

I have a non-admin user "testuser" added to a non-admin "testrole"
I give testrole capabilities of editidentitylookup, editlookups in capabilities.
I log in to my testuser, and I edit identity lookup file, but cannot save.
I also gave "write" permissions to testrole in the Asset and identities files.

Can a non-admin role edit the Identities and Asset files?

0 Karma
Highlighted

Re: Splunk for Enterprise Security: Is it possible to allow non-admin users to edit and save Assets and identities lists manually?

Splunk Employee
Splunk Employee

The list of custom capabilities in ES and the settings that must be changed are listed in the documentation here. Look for the "Manage Lookups" section.

0 Karma