Splunk SOAR

Users & roles visibility

glc_slash_it
Path Finder

Hey splunkers,

We are trying to implement and segregate roles in SOAR, and so we have several roles with several users in them. The problem is that every user can see all other users and assign containers/tasks to them.

Is there a way  to restrict visibility/assignment on other users in the platform? I know it probably have should be realted to users & roles permissions but I' not getting it right...

Thanks

Labels (2)
0 Karma

SOARt_of_Lost
Path Finder

Your best bet is going to be deciding which labels you want to set on certain containers. After that, you can set Label Permissions so roles don't have View permissions on labels they shouldn't see or be assigned to.

0 Karma

mushknizamoffic
Engager

Hello. I like the idea of assigning different labels for separate teams but this also means that if the other role does not have the access to my team's label, I wont be able to escalate/assign the alert to anybody in the other team, right? 

0 Karma

glc_slash_it
Path Finder

Thanks for the answer, but unfortunately that doesn't solve the issue. And I'm puzzled how a platform like SOAR doesnt provide granular user & roles permissions.

We should be able to define that a user can only assing containers/tasks to other users within it's role, instead of everybody(or similar)... 

Because the default settings allows a given user to assign a container to whoever user or roles he wishes...

Does anyone know if there a way using REST API or playbooks?

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Level Up Your .conf25: Splunk Arcade Comes to Boston

With .conf25 right around the corner in Boston, there’s a lot to look forward to — inspiring keynotes, ...

Manual Instrumentation with Splunk Observability Cloud: How to Instrument Frontend ...

Although it might seem daunting, as we’ve seen in this series, manual instrumentation can be straightforward ...

Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform

Ready to make your IT operations smarter and more efficient? Discover how to automate Splunk alerts with Red ...