Capability Template for CISO/ISSO/Analyst

[dathrimar]

Does anyone have a template of capabilities you think are necessary for a role specific to CISOs, ISSM/ISSO, and Analysts. I know we can probably just use the User and Power Users as a baseline but was wondering if anyone had any other inputs or identified specific items they think those roles need.

[PickleRick]

There is no "one size fits all" response to such question. In different organizations those roles can perform different tasks and need to have different access levels to the Splunk infrastructure. The capabilities will also differ depending on what products and apps you are using.

[marnall]

I think you'll have to elaborate on what you think people with those roles will do in Splunk. Will they be viewing "management overview" dashboards? Will they be using Splunk searches to find specific threats or issues? Will they be customizing Splunk by editing knowledge objects like field extractions and lookups?