Yes, I've seen only too many times. But the thing is that it's a symptom of not well-enough defined processed and "undermanaged" environment. Ingest to specific indexes should be covered by proper onboarding process and it should be documented. Searching from an index generally should be covered by roles and therefore users' access. Checking dashboards/reports is a task which might give you false feeling of completness. Let me give you an example. You have a dashboard. The dashboard uses a base search `interesting_indexes` | stats count by host The "interesting_indexes" macro is defined with an app and resoves to "index IN (firewall,hips)". So far so good. But a particular user redefined this macro privately to say "eventtype=windows_logoff". How are you supposed to know that this particular dashboard works differently for that user?
... View more