Splunk phantom warm standby code#

Select View to allow the user to view system settings.Users with edit system settings have the ability to perform a privilege escalation attack. The System Settings include authentication servers. Select Edit to allow the user to change System Settings.Authors without this permission can only use the visual block editor.

Splunk phantom warm standby code#

Select Edit Code to allow playbook authors to manually edit Python code and customize code blocks.

Select Execute to allow the user to execute playbooks on events.

Select View to allow the user to view playbooks.

For more information on playbook settings, see View or edit playbook settings in Splunk Phantom in the Build Playbooks with the Visual Editor manual.

Select Edit to allow the user to edit playbooks, including modifying the playbook settings such as logging, active, safe mode, and draft mode.

Select Delete to allow the user to delete playbooks.

Select View to allow the user to view custom lists.

Select Edit to allow the user to create and edit custom lists.

Select Delete to allow the user to delete custom lists.

This includes both the list of events, as well as the contents of individual events.

Select View to allow the user to view events.

This includes data about the event itself (assigned owner, SLA) as well as being able to add items to artifacts and files.

Select Edit to allow the user to modify events.

Select Delete to allow the user to delete events.

Select View to allow the user to view cases.

Select Edit to allow the user to create and edit cases.

Select Delete to allow the user to delete cases.

Select View to allow the user the ability to look at the list of assets and individual asset configurations.

Select Edit to allow the user add and edit assets.

Note that the user will also need view assets in order to see the asset before they can edit it.

Select Delete to allow the user to delete assets.

Select View to allow the user to view the list of installed apps, and view the settings for individual apps.

Select Edit to allow the user to add or delete apps, or edit settings on individual apps.

Select the Basic Permissions provided by this role.

(Optional) Enter a description for the role.

From the Main Menu, select Administration.

Perform the following steps to add a new role in Splunk Phantom: You can also restrict access to specific named objects. Users granted multiple roles have the cumulative privileges of all the roles. Users with this role can view everything, but cannot edit nor execute anything. They can edit containers and system settings, edit and execute playbooks, and view everything. Users with this role are the equivalent of users with the Administrator role.

Users with this role can view and execute playbooks (but not edit or create them), and view everything else. This is a service account role used for automated tasks including REST API operations, playbook execution, and ingestion. Users with this role can create and edit assets, and view all other parts of the system. Change any and all Splunk Phantom settings.View, edit, and delete permissions for everything.Users with this role have view, edit, and delete privileges to and can access all Splunk Phantom functions and settings: Splunk Phantom includes the following default roles that can't be edited or deleted: Select User Management > Roles & Permissions.From the main menu, select Administration.

To view the roles configured in your Splunk Phantom instance, perform the following steps to access the Roles page:

See Approve actions before they run in Splunk Phantom in the Use Splunk Phantom manual. Act as a mechanism for grouping users for approvals.Grant users permission to access system functionality, or restrict access to parts of the system.Roles in Splunk Phantom serve the following purposes: Manage roles and permissions in Splunk Phantom