Splunk Enterprise Security

How can I restrict a user role access to specific Enterprise Security dashboards?

yashwanth_g_pra
Observer

Hi,

I wanted to create a user account having only access to ES-APP and within which he needs to have access to only incident review, Security Posture, Intrusion Center (present in Security domain -> Network -> Intrusion Centre) dashboards. How can this be done?

0 Karma

Grumpalot
Communicator

To accomplish this for viewing of only those Dashboards/Panels within ES you would have to modify all of the panels/views within ES and remove Read (all) rights. Then you would create a New Role that did not inherit rights from any user and grant the needed index'es/rights for the Role. Then you would select all Roles for viewing minus your new role for the panels/dashboards you did not want view access on, then for the ones that the new User/Role would get View access to you would select that Role also or reselect (all). Again this method will take some time and will take some testing to verify all still works after the change.

0 Karma

lfedak_splunk
Splunk Employee
Splunk Employee

Hey there, This documentation explains how you can create a role with specific permissions.

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...