Following the Installation of ES, an admin configured Leers with the ©ss_uso r role the ability to close notable events. How would the admin restrict these users from being able to change the status of Resolved notable events to closed?

Question

Francisli Lilles · Accepted Answer

From the Status Configuration windows select the closed status. Remove ess_use r from the status transitions for the Resolved status.

Francisli Lilles · Answer

From the Status Configuration window select the Resolved status. Remove ess_user from the status transitions for the closed status.

Francisli Lilles · Answer

In Enterprise Security, give the ess_user role the own Notable Events permission.

Francisli Lilles · Answer

From Splunk Access Controls, select the ess_user role and remove the edit_notabie_events capability.

Question list

List of questions

Question 1

(0)

Question 2

(0)

Question 3

(0)

Question 4

(0)

Question 5

(0)

Question 6

(0)

Question 7

(0)

Question 8

(0)

Question 9

(0)

Question 10

(0)

Related questions

Question 68 - SPLK-3001 discussion

Suggested answer: B

0 comments