Manage capabilities for a role
Capabilities control the level of access that roles have to various features in Splunk Enterprise Security. Use the Roles and capabilities page in Splunk Enterprise Security to review and change the capabilities assigned to a role.
Prerequisite:
Your role must not possess the managed capabilities that are assigned using the Roles and capabilities page in Splunk Enterprise Security. For example, if you want to provide managed access for editing lookups to the role: Edit lookups, this role cannot consist of edit_managed_configurations capability, which can trigger and update the configuration of the lookup.
Steps
- On the Splunk Enterprise Security menu bar, select Configure.
- Select All configurations and then select Roles and capabilities.
- Select and deselect the check boxes to add and remove capabilities to a role. For example, select the ess_user check box for Edit saved views to allow users to edit saved views in the analyst queue.
- Select Save.