advhunt custom Command

[Morty2]

Our Security partners at work recently determined that their analyst need the ability to run the custom command: 

advhunt (TA_ms_advanced_hunting)

The custom command indicates:

• To use this app, users need following privileges.

  • list_storage_passwords
  • admin_all_objects

We do not want to give all Security users the ability to admin_all_objects. What other options do we have? 

[marnall]

I think this "admin_all_objects" privilege is needed by the app to access the client secret stored in the app, which is used to authenticate the advanced hunting requests.

There is another app (https://splunkbase.splunk.com/app/6463) which appears to do the same thing albeit with a differently named command "defkqlg". It says in the Details tab that you can use the "edit_storage_passwords" capability instead of "admin_all_objects" if your Splunk Enterprise version is later than 9.1.0.

It might also be possible to use edit_storage_passwords privilege instead on the MS Defender Advanced Hunting app, but it would need to be tested.