Splunk Enterprise Security

Why is "Edit notable events section" on incident review page not visible?

Path Finder

I'm not getting edit option in incident review page under SplunkEnterpriseSecuritySuite.

I'm using Splunk App for Enterprise Security app version 4.5.0. I'm facing this issue for every users(admin also).

Kindly help me in this to resolve this issue.

Thanks,

0 Karma

Super Champion

This is normally because of Permissions. Try putting your userid role inherits "essadmin" and "admin" and see how it goes

0 Karma

Path Finder

I'm using this with super-admin role also, I've essadmin & admin privileges but none of them working.
Also I upgraded enterprise security app to 4.7.6 but this didn't help.

Thanks,

0 Karma

Splunk Employee
Splunk Employee

What version of Splunk Enterprise are you using? Are there any errors in the browser console?

0 Karma

Path Finder

I'm using Splunk 6.5.3 & Splunk App for Enterprise Security app version 4.5.0. There is no error showing in the browser. Only thing, I'm not seeing any option to edit under the incident review page.

Earlier it was showing and edit notable events section in incident review page is not visible and we couldn't change the status of each of the notable alerts and provide comments.

Please let me know if you need any more info.

Thanks,

0 Karma