You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
At the end of the process, the Splunk user (not admin user) should receive the previously created role. Following is the list of capabilities that covers both the Splunk UI access and using the SplunkPy integration including Enterprise security:
23
+
24
+
<ulclass="bullet-list">
25
+
<li>accelerate_search</li>
26
+
<li>admin_all_objects</li>
27
+
<li>can_own_notable_events</li>
28
+
<li>change_own_password</li>
29
+
<li>edit_analyticstories</li>
30
+
<li>edit_cam_queue</li>
31
+
<li>edit_correlationsearches</li>
32
+
<li>edit_lookups</li>
33
+
<li>edit_notable_events</li>
34
+
<li>edit_own_objects</li>
35
+
<li>edit_tcp</li>
36
+
<li>edit_tcp_stream</li>
37
+
<li>edit_upload_and_index</li>
38
+
<li>get_metadata</li>
39
+
<li>get_typeahead</li>
40
+
<li>input_file</li>
41
+
<li>list_accelerate_search</li>
42
+
<li>list_all_objects</li>
43
+
<li>list_inputs</li>
44
+
<li>list_introspection</li>
45
+
<li>list_metrics_catalog</li>
46
+
<li>list_search_head_clustering</li>
47
+
<li>manage_all_investigations</li>
48
+
<li>manage_behavioral_analytics</li>
49
+
<li>output_file</li>
50
+
<li>rest_access_server_endpoints</li>
51
+
<li>rest_apps_view</li>
52
+
<li>rest_properties_get</li>
53
+
<li>rest_properties_set</li>
54
+
<li>rtsearch</li>
55
+
<li>run_collect</li>
56
+
<li>run_mcollect</li>
57
+
<li>run_msearch</li>
58
+
<li>run_sendalert</li>
59
+
<li>schedule_rtsearch</li>
60
+
<li>schedule_search</li>
61
+
<li>search</li>
62
+
<li>search_process_config_refresh</li>
63
+
<li>upload_lookup_files</li>
64
+
</ul>
65
+
66
+
67
+
#### SplunkPy command permissions by example:
68
+
`splunk-notable-event-edit`
69
+
70
+
custom roles required: (at least one)
71
+
ess_analyst, ess_admin
72
+
Can replace the Splunk power role for ES users.
73
+
74
+
User-Level Permissions:
75
+
Read: Access to view resources (e.g., dashboards, reports).
76
+
Write: Ability to modify existing resources or create new ones.
77
+
78
+
79
+
### Query Load Analysis
80
+
#### Mirroring
81
+
82
+
When mirroring in enabled, 2-3 simultaneous queries are expected.
83
+
Each query can have more that one API call. On mirror out - API call for updating each notable event that changed. This also includes User mapping queries and mirroring queries.
84
+
85
+
#### Enrichment
86
+
87
+
Fetching notable event - for each fetch iteration 2 queries.
88
+
For each notable event that fetched - we have 3 enrichments(max).
89
+
`<Amount of fetched notables> * <amount of defined enrichments>`
90
+
In case of more that one drilldown - number of drilldown queries.
91
+
Each query can have more that one API call.
92
+
93
+
#### Fetch
94
+
95
+
Configured by the instance configuration fetch_limit (behind the scenes an query can made few API calls).
0 commit comments