Skip to content

Commit

Permalink
Update savedsearches.conf
Browse files Browse the repository at this point in the history
  • Loading branch information
gjanders committed May 21, 2024
1 parent 9dcb489 commit 9f2424b
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion default/savedsearches.conf
Original file line number Diff line number Diff line change
Expand Up @@ -6607,7 +6607,7 @@ alert.severity = 2
counttype = number of events
cron_schedule = 43 4 * * *
description = Chance the alert requires action? Moderate. this alert attempts to find a list of roles that have capabilities the admin (or roles inheriting) the admin role do not have. The issue with this is that the Settings -> Users UI page, or in the /services/authentication/users REST endpoint will not show users *if* the grantableRoles setting is used on that particular role. Since this setting can be set by the UI itself it an issue can occur that some users do not appear in Settings -> Users but are cached by Splunk correctly, you just cannot see them. \
The page https://docs.splunk.com/Documentation/Splunk/latest/Admin/authorizeconf descrbies the grantableRoles setting in more detail, this is definitely an edge case but it may be worth detecting...
The page https://docs.splunk.com/Documentation/Splunk/latest/Admin/authorizeconf describes the grantableRoles setting in more detail, this is definitely an edge case but it may be worth detecting...
dispatch.earliest_time = -1d@h
dispatch.latest_time = now
display.events.fields = ["host","source","sourcetype"]
Expand Down

0 comments on commit 9f2424b

Please sign in to comment.