ITSI capabilities reference

This table lists ITSI capabilities for each default role. When you create a user in ITSI, you assign that user one or more roles. Each role contains a set of capabilities. You can add or edit capabilities for new, existing, and default roles. For example, you might give a role the capability to create a shared glass table or delete a KPI base search. A write capability implies create and update. Delete is its own capability. If you modify the capabilities for custom roles, you also need to assign the role proper view-level access. For instructions, see Assign the role proper view-level access.

Capabilities are subject to change. For the most up-to-date list of capabilities, see $SPLUNK_HOME/etc/apps/SA-ITOA/default/authorize.conf. For information about the capabilities assigned to ITSI roles, see Restrict access to objects in ITSI. This capability reference only shows capabilities corresponding to each default role. Custom roles can inherit a default role along with that role's capabilities. To learn more about the relationship between default and custom roles, see Custom roles for teams.

A role that has a service capability has analogous capabilities for the KPI and entity type objects.

SA-ITOA Object type	Capability name	Capability description	itoa_user	itoa_analyst	itoa_team_admin	itoa_admin
RBAC Permissions Configuration	configure_perms	Configure role based access control on shared service analyzers, deep dives, glass tables, correlation searches, and notable event aggregation policies.			X	X
Service/KPIs/Entity	read_itsi_service	Read service-based information in service analyzers, pull in service-based information on a glass table or deep dive, and list services and entities.	X	X	X	X
	write_itsi_service	Create a service, KPI, and entity, and bulk import entities and services.			X	X
	delete_itsi_services	Delete a service, KPI, or entity.			X	X
	read_itsi_kpi_state_cache	View the state cache for KPIs.	X	X	X	X
	write_itsi_kpi_state_cache	Edit the state cache for KPIs.			X	X
	delete_itsi_kpi_state_cache	Delete the state cache for KPIs.			X	X
	read_itsi_custom_threshold_windows	View KPI custom threshold windows.			X	X
	write_itsi_custom_threshold_windows	Create KPI custom threshold windows.			X	X
	delete_itsi_custom_threshold_windows	Remove KPI custom threshold windows.			X	X
	read_itsi_kpi_entity_threshold	View entity thresholds.			X	X
	write_itsi_kpi_entity_threshold	Create entity thresholds.			X	X
	delete_itsi_kpi_entity_threshold	Delete entity thresholds.			X	X
	read_itsi_kpi_at_info	View KPI adaptive thresholds.			X	X
	write_itsi_kpi_at_info	Create KPI adaptive thresholds.			X	X
	delete_itsi_kpi_at_info	Remove KPI adaptive thresholds.			X	X
Service Templates	read_itsi_base_service_template	View a service template.	X	X	X	X
	write_itsi_base_service_template	Create a service template.				X
	delete_itsi_base_service_template	Delete a service template.				X
Temporary KPIs	read_itsi_temporary_kpi	Read a KPI with time policy.	X	X	X	X
	write_itsi_temporary_kpi	Create a KPI with time policy.	X	X	X	X
	delete_itsi_temporary_kpi	Delete a KPI with time policy.	X	X	X	X
KPI Base Searches	read_itsi_kpi_base_search	Read a KPI base search.	X	X	X	X
	write_itsi_kpi_base_search	Write a KPI base search.			X	X
	delete_itsi_kpi_base_search	Delete a KPI base search.			X	X
KPI Threshold Templates	read_itsi_kpi_threshold_template	Read KPI threshold template type objects.	X	X	X	X
	write_itsi_kpi_threshold_template	Write a custom KPI threshold template.			X	X
	delete_itsi_kpi_threshold_template	Delete a KPI threshold template.			X	X
Entity discovery search	read_itsi_entity_discovery_searches	View entity discovery searches for entities.			X	X
	write_itsi_entity_discovery_searches	Edit entity discovery searches for entities.				X
Entity management policy	read_itsi_entity_management_policies	View entity management policies for entities.	X	X	X	X
	write_itsi_entity_management_policies	Create entity management policies for entities.			X	X
	delete_itsi_entity_management_policies	Remove entity management policies for entities.			X	X
Backup/Restore	read_itsi_backup_restore	Read backup/restore page.				X
	write_itsi_backup_restore	Create a backup/restore job.				X
	delete_itsi_backup_restore	Delete a backup/restore job.				X
Glass Table	read_itsi_glass_table	View shared glass tables.	X	X	X	X
	write_itsi_glass_table	Create and edit a shared glass table. Does not include the ability to drill down in view mode.		X	X	X
	delete_itsi_glass_table	Delete a shared glass table.		X	X	X
	interact_with_itsi_glass_table	Drill down and interact with glass tables.	X	X	X	X
Deep Dive	read_itsi_deep_dive	View a shared deep dive.	X	X	X	X
	write_itsi_deep_dive	Create a shared deep dive.		X	X	X
	delete_itsi_deep_dive	Delete a shared deep dive.		X	X	X
	interact_with_itsi_deep_dives	Drill down and interact with deep dives.	X	X	X	X
	read_itsi_deep_dive_context	Drill down to an automatically-generated deep dive object.	X	X	X	X
	write_itsi_deep_dive_context	Drill down to an automatically-generated deep dive object for the first time.	X	X	X	X
	delete_itsi_deep_dive_context	Delete an automatically-generated deep dive object.	X	X	X	X
	interact_with_itsi_deep_dives_context	Drill down and interact in deep dives context.	X	X	X	X
Service Analyzer	read_itsi_homeview	Read service analyzers.	X	X	X	X
	write_itsi_homeview	Create or edit a service analyzer.	X	X	X	X
	delete_itsi_homeview	Delete a service analyzer.	X	X	X	X
	interact_with_itsi_homeview	Drill down and interact with a service analyzer.	X	X	X	X
Correlation Search	read_itsi_correlation_search	Read a correlation search.	X	X	X	X
	write_itsi_correlation_search	Edit a correlation search.			X	X
	delete_itsi_correlation_search	Delete a correlation search.			X	X
	interact_with_itsi_correlation_search	Drill down and interact with a correlation search.			X	X
Event Management State	read_itsi_event_management_state	Read Episode Review dashboards.	X	X	X	X
	write_itsi_event_management_state	Save an Episode Review dashboard.	X	X	X	X
	delete_itsi_event_management_state	Delete an Episode Review dashboard.	X	X	X	X
	interact_with_itsi_event_management_state	Drill down and interact with an Episode Review dashboard.	X	X	X	X
Event management	edit_token_http	Run an episode action, and update episode owner, severity, and status.		X	X	X
Notable Event	read_notable_event	Read a notable event.	X	X	X	X
	write_notable_event	Modify a notable event on index. Requires delete_by_keyword and edit_token_http capabilities to be enabled.		X	X	X
	delete_notable_event	Delete an episode.		X	X	X
Notable Event Aggregation Policy	read_itsi_notable_aggregation_policy	Read a notable event aggregation policy.		X	X	X
	write_itsi_notable_aggregation_policy	Write a notable event aggregation policy.			X	X
	delete_itsi_notable_aggregation_policy	Delete a notable event aggregation policy.			X	X
	edit_default_itsi_notable_aggregation_policy	Edit the default notable event aggregation policy.				X
	interact_with_itsi_notable_aggregation_policy	Drill down and interact with notable event aggregation policies.			X	X
Episode actions	read_notable_event_action	Read an episode action.	X	X	X	X
	execute_notable_event_action	Run an episode action, and update episode owner, severity, and status.		X	X	X
Email templates	read_itsi_notable_event_email_template	Read an email template.		X	X	X
	write_itsi_notable_event_email_template	Edit an email template.		X	X	X
	delete_itsi_notable_event_email_template	Delete an email template.		X	X	X
Maintenance services	read_maintenance_calendar	Read a maintenance window.	X	X	X	X
	write_maintenance_calendar	Write a maintenance window.			X	X
	delete_maintenance_calendar	Delete a maintenance window.			X	X
	delete_module_interface	Delete an ITSI module and KPIs provided by modules.			X	X
CSV Import mod input	edit_modinput_itsi_csv_import	Save the modular input for CSV import.				X
Teams	read_itsi_team	Read objects for a team.	X	X	X	X
	write_itsi_team	Create or update objects for a team.				X
	delete_itsi_team	Delete objects for a team.				X
Bulk import	bulk_import_service_or_entity	Create services or entities using bulk import.			X	X
Episode exports	read_itsi_event_management_export	View CSV downloads for episode exports.		X	X	X
	write_itsi_event_management_export	Write CSV downloads for episode exports.		X	X	X
	delete_itsi_event_management_export	Delete CSV downloads for episode exports.		X	X	X
Content Pack/Integrations	read_itsi_data_integration	View content packs and ITSI data integrations.		X	X	X
	write_itsi_data_integration	Create content packs and add ITSI data integrations.			X	X
	delete_itsi_data_integration	Remove content packs and add ITSI data integrations.			X	X
Content Pack/Integrations	read_itsi_data_integration	View content packs and ITSI data integrations.		X	X	X
	write_itsi_data_integration	Create content packs and ITSI data integrations.			X	X
	delete_itsi_data_integration	Delete content packs and ITSI data integrations.			X	X
Sandbox	read_itsi_sandbox	View service sandboxes.	X	X	X	X
	write_itsi_sandbox	Create service sandboxes.			X	X
	delete_itsi_sandbox	Remove service sandboxes.				X
	read_itsi_sandbox_sync_log	View service sandbox logs.	X	X	X	X
	write_itsi_sandbox_sync_log	Edit service sandbox logs.			X	X
	delete_itsi_sandbox_sync_log	Edit service sandbox logs.			X	X
Refresh queue	read_itsi_refresh_queue_job	View the refresh queue job details.	X	X	X	X
	write_itsi_refresh_queue_job	Edit the refresh queue job details.	X	X	X	X
	delete_itsi_refresh_queue_job	Remove the refresh queue job details.	X	X	X	X
Admin console	read_itsi_admin_console	View the Configuration Assistant,				X
	write_itsi_admin_console	Update the Configuration Assistant,				X