Hi , In a Splunk Cloud instance - installed Alert Manager with all default settings - The incident setting is all  enabled - User setting is configured to "Both" .   Trying to assign an incident to another member - but I can not make any changes to incident workflow in the Edit Incident box.  what files need to be modified on the Splunk cloud instance to allow any member to assign incidents to another member as well as leave comments .  Not sure if that is related to Notification - because that is not functional as well - created the member notifications schemes but can not add the emails address for each member?  Seem to be some files need to be modified on the Splunk cloud instance for these app - any help will be much appreciated.    ... View more

Hi folks,  I am new to alert manager and I am trying to configure it - I have splunk cloud - hence my access to the config files is limited .  so far the alerts are all going across without any issue - but when I try to assign it to another person - it seem that it wont let me save any updates or let me reassign the alert entry. Any ideas which file I need to make changes to and what are the changes - I need to be very specific for the Splunk Support team for Cloud services   Any help would be greatly appreciated.  ... View more

Brute Force and Spray attacks - use case  1- Multiple accounts failed logon from the same IP - within 1 minute 2- Single account failed logon from multiple hosts - in 1 minute 3- 1 user account failed to  log to 3 hosts destination - in 2 minutes   ... View more