Users and roles for Splunk Enterprise Security versions 8.8 and higher

Splunk Enterprise Security uses the access control system integrated with the Splunk platform. The Splunk platform authorization allows you to add users, assign users to roles, and assign those roles capabilities to provide granular, role-based access control for your organization.

CAUTION: There are scenarios where it's possible for an authenticated user to interact with certain core resources outside the control of Splunk Enterprise Security, which can result in a lack of auditability. Make sure that all users with access to Splunk Enterprise Security are trusted users, who have access to related data, such as findings and investigations.

Splunk Enterprise Security versions 8.8 and higher offers a unified experience to create, manage, and maintain custom roles and assign permissions through role based user access across detections, findings and investigations, threat intelligence, assets and identities, and User and Entity Behavior Analytics (UEBA).

You can use existing roles as a reference to create custom roles that can be assigned to analysts. You can also create new custom roles using role templates and provide access to team queues.

You can automate role management using REST API endpoints. For more information, see the Splunk Enterprise Security API reference manual.

For troubleshooting information on roles and capabilities, see Troubleshoot roles and capabilities.

Security users

Splunk Enterprise Security adds three roles to the default roles provided by the Splunk platform. The new roles allow a Splunk administrator to assign access to specific functions in Splunk Enterprise Security based on a user's access requirements. The Splunk platform administrator can assign groups of users to the roles that best fit the tasks the users perform and manage in Splunk Enterprise Security.

Each Splunk Enterprise Security role inherits other Splunk platform roles and adds capabilities specific to Splunk Enterprise Security. Not all of the Splunk Enterprise Security roles can be assigned directly to users.

The following table describes the roles specific to Splunk Enterprise Security:

Splunk Enterprise Security role Role inherited from Splunk platform Added Splunk Enterprise Security capabilities Assign to users?
ess_user user Real-time search, list search head clustering, edit Splunk eventtypes in the threat Intelligence supporting add-on, manage suppressions of findings. Yes. Replaces the user role for Splunk Enterprise Security users.
ess_analyst user, ess_user, power Inherits ess_user and adds the capabilities to create, edit, and own findings and perform all transitions, and create and modify investigations. Yes. Replaces the power role for Splunk Enterprise Security users.
ess_admin user, ess_user, power, ess_analyst Inherits ess_analyst and adds several other capabilities. No. You must use a Splunk platform admin role to administer a Splunk Enterprise Security installation.
Note: The ess_admin is a container of capabilities provided by Splunk Enterprise Security to the system administrator role, which allows you to install and configure Splunk Enterprise Security. The ess_admin role must not be assigned to users because though the role provides custom capabilities, the user does not have access to access control lists (ACLs).

The Splunk platform admin role inherits all unique Splunk Enterprise Security capabilities. In a Splunk Cloud Platform deployment, the Splunk platform admin role is called sc_admin. Use the admin or sc_admin role to administer a Splunk Enterprise Security installation.

Splunk Enterprise Security roles

Splunk Enterprise Security adds three roles to the default roles provided by the Splunk platform. The new roles allow a Splunk administrator to assign access to specific functions in Splunk Enterprise Security based on a user's access requirements. The Splunk platform administrator can assign groups of users to the roles that best fit the tasks the users perform and manage in Splunk Enterprise Security.

Each Splunk Enterprise Security role inherits other Splunk platform roles and adds capabilities specific to Splunk Enterprise Security. Not all of the Splunk Enterprise Security roles can be assigned directly to users.

The following table describes the roles specific to Splunk Enterprise Security:

Splunk Enterprise Security role Role inherited from Splunk platform Added Splunk Enterprise Security capabilities Assign to users?
ess_user user Real-time search, list search head clustering, edit Splunk eventtypes in the threat Intelligence supporting add-on, manage suppressions of findings. Yes. Replaces the user role for Splunk Enterprise Security users.
ess_analyst user, ess_user, power Inherits ess_user and adds the capabilities to create, edit, and own findings and perform all transitions, and create and modify investigations. Yes. Replaces the power role for Splunk Enterprise Security users.
ess_admin user, ess_user, power, ess_analyst Inherits ess_analyst and adds several other capabilities. No. You must use a Splunk platform admin role to administer a Splunk Enterprise Security installation.
Note: The ess_admin is a container of capabilities provided by Splunk Enterprise Security to the system administrator role, which allows you to install and configure Splunk Enterprise Security. The ess_admin role must not be assigned to users because though the role provides custom capabilities, the user does not have access to access control lists (ACLs).

The Splunk platform admin role inherits all unique Splunk Enterprise Security capabilities. In a Splunk Cloud Platform deployment, the Splunk platform admin role is called sc_admin. Use the admin or sc_admin role to administer a Splunk Enterprise Security installation.

View and modify existing roles and capabilities in Splunk Enterprise Security version 8.8 and higher

Create, duplicate, edit, and delete predefined custom roles for analysts without granting unnecessary access. Predefined roles can be a good starting point to create new roles that are a close match to your requirements without inheriting roles or modifying the existing role.

Prerequisite: You must be a Splunk Enterprise Security administrator with the admin_all_objects capability to define custom roles and capabilities.

Note: If you don't have the administrator role with the admin_all_objects capability, you see an error message indicating that you don't have access.

Follow these steps to view and modify existing roles and capabilities in Splunk Enterprise Security version 8.8 and higher:

  1. In Splunk Enterprise Security, go to Configure.

  2. Select All configurations and then go to General settings.

  3. Select Roles and permissions.

  4. Go to the Roles tab. This page provides the unified experience to manage custom roles, assign permissions, use role templates, and control access to team-based queues. The Role name is the role identifier used in the configuration files and REST API endpoints and the Display name offers a more descriptive version of the role.

  5. Select ES analyst to view the predefined roles that are assigned to the analyst.
    Note: You can search or sort predefined custom roles.
  6. Review, edit, or duplicate predefined roles using the role actions.

Use role templates to create new custom roles

Use role templates to create new custom roles with specific capabilities. Role templates provide a recommended starting point to assign permissions to roles.​ The following role templates based on the common security personas are provided in Splunk Enterprise Security version 8.8 and higher:

  • Asset and identity engineer: Maintains asset and identity inventories, configures lookup sources, and manages data quality.
  • Detection engineer: Authors, tunes, and manages detections, analytic stories, risk factors, and enrichment lookups.
  • Exposure analytics analyst: Accesses exposure analytics reporting within Splunk Enterprise Security.
  • SOC analyst: Performs day to day triage and response to findings and investigations.
  • SOC manager: Configures analyst workflows, oversees queue operations, and triage.
  • SOC auditor: Compliance auditors and GRC analysts with read-only access to all Splunk Enterprise Security configurations to validate security controls.
  • SOC viewer: Monitors SOC activity and reviews investigation status without participating in triage or response.
  • Threat intelligence analyst: Manages threat intelligence sources, curates indicator collections, and validates threat intelligence enrichment
  • UEBA detection engineer: Tunes and enriches UEBA detections within Splunk Enterprise Security.
  • UEBA risk analyst: Performs triage on risk-based entities, manages UEBA resources, creates and updates investigations from UEBA.
  • UEBA risk viewer: Reviews UEBA dashboards, entity details, detection context, health and related investigation status.

All new custom roles created using role templates automatically inherit the baseline capabilities of a Splunk user. Selecting multiple role templates copies the combined permissions of these role templates into the new custom role.​ Creating a custom role using a role template does not automatically assign it to any analyst. As an administrator, you must assign the role to the analyst. Other apps can also contribute to role templates.

Splunk Enterprise Security does not provide default roles using role templates. You can create custom roles as an administrator from the role template and modify its permissions.

Alternatively, you can create a custom role without a template and copy permissions or capabilities from one or more roles. If no role template or predefined role is used for duplication, no permissions are copied to the new role.

Note: You can search or sort custom roles. You can also review, edit, or delete custom roles through the role actions. You can also delete multiple custom roles at the same time.

Prerequisite: You must be a Splunk Enterprise Security administrator with the admin_all_objects capability to define custom roles and capabilities.

Follow these steps to use role templates to create new custom roles in Splunk Enterprise Security version 8.8 and higher:

  1. In Splunk Enterprise Security, go to Configure.

  2. Select All configurations and then go to General settings.

  3. Select Roles and permissions.

  4. Select the Role templates tab.

  5. Select any of the role templates to view the capabilities associated with the role template. The Role templates tab shows each template's name, description, source application, and included permissions. Other installed apps can also contribute role templates.
    Note: You must review the source application and the permissions in a third-party template before using it. Updating a role template in a later version of Splunk Enterprise Security or a later version of an app does not automatically change roles that were previously created from that role template. Administrators must review and apply any desired changes to the role template.

  6. Copy a role template as is to create a new custom role. Copying a role template is a one-time discrete action so changes made later to the role template are not copied into the new role.​

  7. Select Add custom role.

  8. Enter a display name and description for the custom role.

  9. (optional) In the Copy role template permissions, enter a role template. For example, Detection engineer.

  10. Select Add to create the new custom role. Once the role is created, the Permissions tab allows you to navigate to the permissions associated with the specific tasks that the role must perform.

  11. In the Permissions tab, go to Team-based queues to grant role access to specific queues.

    Note: A permission can represent several Splunk capabilities and access-control settings. You must manage permissions as a unit. Predefined roles are visible but read-only.​ An inherited permission must be changed on the role that grants it.​ Some permissions might imply others. A required permission remains selected until the permission that depends on it is removed.​

  12. Select Save.