Following the installation of ES, an admin configured users with the ess_user role the ability to close notable events.
How would the admin restrict these users from being able to change the status of Resolved notable events to Closed?

Question

Following the installation of ES, an admin configured users with the ess_user role the ability to close notable events.

How would the admin restrict these users from being able to change the status of Resolved notable events to Closed?

Ages Handriyanto · Accepted Answer

From the Status Configuration window select the Resolved status. Remove ess_user from the status transitions for the Closed status.

Ages Handriyanto · Answer

In Enterprise Security, give the ess_user role the Own Notable Events permission.

Ages Handriyanto · Answer

From the Status Configuration window select the Closed status. Remove ess_user from the status transitions for the Resolved status.

Ages Handriyanto · Answer

From Splunk Access Controls, select the ess_user role and remove the edit_notable_events capability.

List of questions