About Panssa

Panssa · ‎07-05-2016

We have users with user role. They have capabilities: accelerate_search change_own_password edit_tcp embed_report get_metadata get_typeahead input_file list_inputs output_file pattern_detect request_remote_tok rest_apps_view rest_properties_get rest_properties_set schedule_rtsearch schedule_search search If I add capability: admin_all_objects users can add Web-pages input. I dont't want to grant that capability, is there some other way?

Panssa · ‎04-03-2016

Thanks for answer! Some comments: 1. Yes, logs are actually in the pan_logs index 2. Network_logs can see pan_logs index, search index=pan_logs works fine with this role. 3. I made some changes to roles -> no Restrict search term and available index: pan_logs, and now app works, but this is not the solution I want to use. We have other issues, so we need the use 'Restrict search terms' Splunk Support answered to me that this is app related question.

Panssa · ‎03-24-2016

I have users with user and alert_manager role. They have capabilities: accelerate_search change_own_password edit_tcp embed_report get_metadata get_typeahead input_file list_inputs output_file pattern_detect request_remote_tok rest_apps_view rest_properties_get rest_properties_set schedule_rtsearch schedule_search search but if they make alerts with actions: Send email, Add to Triggered Alerts and Alert Manager, only Send email and Add to Triggered Alerts works. Alert Manager dont display Alert. But if I add capability: admin_all_objects Alert displays in Incident Posture. I dont't want to grant that capability, is there some other way?

Panssa · ‎03-21-2016

Problem with user roles in Palo Alto app I have two different roles, both inherited with user privilegies. Roles are: All_logs and Network_logs Only difference between those roles are that All_logs have Restrict search terms: * and Network_logs Restrict search terms: index=pan_logs And the problem is with Palo Alto Networks app, users who belongs to All_logs role, everything is working fine, but users with Network_logs don't see anything with app, but search "index=pan_logs" works fine. Why app doesn't show information? For example Threat Dashboard gives "Search produced no results" information under dropdown menus, and all panels give "No results found"

Posts	4
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎12-29-2014

Online Status	Offline
Date Last Visited	‎09-24-2021 12:28 AM

We have non-admin users who should have access to ...

What roles or capabilities are needed that Alerts ...

Problem with user roles in Palo Alto app

We have non-admin users who should have access to ...

Re: Problem with user roles in Palo Alto app

What roles or capabilities are needed that Alerts ...

Problem with user roles in Palo Alto app