Splunk Enterprise Security

How to create investigations in ES 5.2.2?

chrispounds
Explorer

Hi all,

So i have added the edit_timeline role to a user and they can create an investigation, but after you click "start investigation" they are greeted with a "failed to retrieve investigation" message. I was under the impression it was just the one user role needed for investigations, has anyone come across this before?

Many thanks,

0 Karma
1 Solution

smoir_splunk
Splunk Employee
Splunk Employee

Per the documentation, they need the "Manage Your Investigations" capability
https://docs.splunk.com/Documentation/ES/5.2.2/Admin/Manageinvestigations
which as you correctly identify is the edit_timeline capability (not a role, but is by default included for the ess_analyst role).

If you added this capability using the ES Permissions page, it should be working. If you added the capability using authorize.conf, some necessary ACLs might be missing. Check the ES Permissions page, and/or verify that the users have the ess_analyst role (unless you are using custom roles).

View solution in original post

smoir_splunk
Splunk Employee
Splunk Employee

Per the documentation, they need the "Manage Your Investigations" capability
https://docs.splunk.com/Documentation/ES/5.2.2/Admin/Manageinvestigations
which as you correctly identify is the edit_timeline capability (not a role, but is by default included for the ess_analyst role).

If you added this capability using the ES Permissions page, it should be working. If you added the capability using authorize.conf, some necessary ACLs might be missing. Check the ES Permissions page, and/or verify that the users have the ess_analyst role (unless you are using custom roles).

chrispounds
Explorer

Thank you smoir 🙂

0 Karma

chrispounds
Explorer

So we currently have custom roles for our ES system.

sec_user -> inherits normal user with added capabilities (edit_timeline).

But when i view sec_user's "imported capabilities", edit_timeline doesn't appear, so perhaps it isn't inheriting the capability correctly? Although this wouldn't explain why the user can create the investigation, but receives an error when trying to view.

I have checked the investigation as admin and can confirm it's working as expected, so must be a permission hick up somewhere!

0 Karma

pschulz_splunk
Splunk Employee
Splunk Employee

when the user is missing edit_timeline capability you should see: 'You do not have permission to access investigations.'
There is probably something else going on, you should check if there are failing network requests.

0 Karma

smoir_splunk
Splunk Employee
Splunk Employee

Yeah, that does sound odd. I'd suggest using the ES permissions page to manually add the capability to the sec_user role, or to re-add it to the "normal user" account and see if that fixes the issue.

0 Karma
Get Updates on the Splunk Community!

Splunk Classroom Chronicles: Training Tales and Testimonials

Welcome to the "Splunk Classroom Chronicles" series, created to help curious, career-minded learners get ...

Access Tokens Page - New & Improved

Splunk Observability Cloud recently launched an improved design for the access tokens page for better ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...