The navigation bar in Splunk Enterprise Security version 8.0 was updated. If you customized the navigation menu bar and want to maintain the customized options, add the following code snippet to the custom navigation Configure tab. Adding this code snippet lets you maintain your customized menu bar options and have access to all Splunk Enterprise Security version 8.0 features.

<collection label="ES 8.0">
    <collection label="Security Content">
        <a name="risk_factor_editor" href='/app/SplunkEnterpriseSecuritySuite/risk_factor_editor'>Risk factors</a>
        <a name="response_plan" href='/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/response_plan'>Response plans</a>
        <divider />
        <a name="soar_playbooks" href='/app/SplunkEnterpriseSecuritySuite/soar_redirect?next_url=/playbooks' target="_blank">SOAR playbooks</a>
    </collection>
    <collection label="Configurations">
        <a name="ess_configuration" href='/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/'>All configurations</a>
        <divider />
        <a name="general" href='/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/general/general_settings'>General settings</a>
        <a name="findings_investigations" href='/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/findings_investigations/investigation-types'>Findings and investigations</a>
        <a name="datasets" href='/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/data/datasets'>Datasets</a>
        <a name="intelligence" href='/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/intelligence/sources'>Threat intelligence</a>
        <divider />
        <a name="soar" href='/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/soar/soar_pairing'>Splunk SOAR</a>
        <a name="uba" href='/app/SplunkEnterpriseSecuritySuite/ess_configuration/#/splunk_uba/pairing'>Splunk UBA</a>
    </collection>
  </collection>

Views and collections that are new, updated, or deprecated in the version of the app that you have installed are highlighted with small icons that indicate the relevant changes. The U and D icons are for purely informational purposes and no action is required.

.

After installing a new version of Splunk Enterprise Security or a new version of an app that provides views and collections for use in Splunk Enterprise Security, visit the Navigation page to check for updates to those views and collections.

Follow these steps to check for updated views in Splunk Enterprise Security:

1. In the Splunk Enterprise Security app, select Configure.
2. Select General settings, and then select Navigation. If any content is updated, the message "Some content updates available" appears at the top of the navigation editor.
3. Look for icons on the views on the editor pane to find content that has been added, updated, or deprecated. These same icons also appear in the Add a new view and Add a new collection menus.

To see a specific view when you or other users open Splunk Enterprise Security, set a default view.

Follow these steps to set up a default view for Splunk Enterprise Security:

1. In the Splunk Enterprise Security app, select Configure.
2. Select General settings and then select Navigation.
3. Locate the view that you want to be the default view.
4. Select the checkmark icon that appears when you mouse over the view to Set this as the default view.
   
5. Select Save to save your changes.
6. Select OK to refresh the page and view your changes.

You can edit the existing navigation bar in Splunk Enterprise Security to customize it based on your requirements.

Follow these steps to edit the existing menu bar navigation:

1. In the Splunk Enterprise Security app, select Configure.
2. Select General settings and then select Navigation.
3. Select and drag views or collections of views to change the location of the views or collections of views in the menu.
4. Select the X next to a view or collection to remove it from the menu.
5. Select the pencil icon to edit the name of a collection.
6. Select the divider icon to add a divider and visually separate items in a collection.
7. Select Save to save your changes.
8. Select OK to refresh the page and view your changes.

You can add a new view to the menu bar of Splunk Enterprise Security without adding it to a collection.

Follow these steps to add a new view to Splunk Enterprise Security:

1. In the Splunk Enterprise Security app, select Configure.
2. Select General settings and then select Navigation.
3. In the Navigation page, select Add a new view.
4. Leave View Options set to the default of View.
5. Select Select a View from Unused Views.
6. Select a dashboard or view from the drop-down list.
7. Select Save. The dashboard appears on the navigation editor.
8. After you finish adding items to the menu, select Save to save your changes
9. Select OK to refresh the page and view your changes.

Use a collection to organize several views or links together in the Splunk Enterprise Security menu bar.

Follow these steps to add a collection to the Splunk Enterprise Security menu bar:

1. In the Splunk Enterprise Security app, select Configure.
2. Select General settings, and then select Navigation.
3. In the Navigation page, select Add a new collection.
4. Enter a Name. For example, Audit.
5. Select Save. The collection appears on the navigation editor.

You must add a view or link to the collection before it appears in the menu navigation.

Add views to an existing collection of views.

Follow these steps to add a view to an existing collections of views:

1. In the Splunk Enterprise Security app, select Configure.
2. Select General settings, and then select Navigation.
3. Locate the collection that you want to add views to.
4. Select the view icon.
5. Leave View Options set to the default of View.
6. Select Select a View from Unused Views.
7. Select a view from the list.
8. Select Save. The view appears on the navigation editor.
9. After you finish adding items to the menu, select Save to save your changes
10. Select OK to refresh the page and view your changes.

You can add a link to the menu bar of Splunk Enterprise Security. For example, add a link to a specifically-filtered view of the Mission Control page or to an external ticketing system.

Follow these steps to restore the default navigation of the Splunk Enterprise Security menu bar:

1. In the Splunk Enterprise Security app, select Configure.
2. Select General settings, and then select Navigation.
3. Select Restore default configuration.
4. Select OK to confirm.
5. Select Save.

For more information on how to configure user roles in Splunk Enterprise Security, see the product documentation:

Configure users and roles in Splunk Enterprise Security in the Install and Upgrade Splunk Enterprise Security Manual.