Hello Team, I have a requirement from a client that each team should have a separate case management system and they can only see their cases and the teams should be able to escalate the case to a different team too. I know that for each team, I can give label permission for specific team. In this way they can only see labels that they have access of but in this way they will not be able to assign the case to the different team. I can not find an official documentation from splunk soar, so if you can help me figure this out I would be very grateful. ... View more

Hello, I have installed Splunk Soar (on-premise) recently using the splunk documentation, and I want to generate a report on the event. But, it gives report generation failed.       ... View more

Hello, I’m working on a use case in Splunk SOAR where I’ve structured alerts using labels to separate visibility between teams. This allows each team to focus only on their own alerts, avoiding confusion and overlap. The access is controlled through roles, so a user/team only sees alerts tied to their specific label. The challenge I’m facing is with cross-team assignments. If a user from Team A (with Label A) wants to assign or escalate an alert to someone in Team B (with Label B), this isn’t possible because they don’t have access to that other label. I’d like to know: Is there any supported method or workaround to allow cross-team assignment while still preserving restricted visibility? If such a transfer/escalation is possible, can the alert be hidden from the original team’s view once it has been reassigned to the new team? The goal is to maintain clean separation of alerts per team while still allowing escalation paths between them. Any guidance or best practices would be greatly appreciated. Thank you! ... View more