Splunk® Enterprise Security

Use Splunk Enterprise Security

Download manual as PDF

This documentation does not apply to the most recent version of ES. Click here for the latest version.
Download topic as PDF

Collaborate on an investigation in Splunk Enterprise Security

You can collaborate with other analysts on an investigation.

Add a collaborator to an investigation

  1. Open the investigation that you want to add a collaborator to.
  2. Click the add collaborators icon.
  3. Type the name of the person you want to add and select their name from the list to add them to the investigation.
    This screen image shows the list of collaborators that appear when you click the add collaborators plus icon.
  4. Their initials appear in a circle to confirm that they were added.

You can add any Splunk user in your deployment as a collaborator. By default, a collaborator has write permissions on the investigation. The option to add more collaborators to an investigation disappears if all available users have been added to the investigation.

View the collaborators assigned to an investigation

You can view the collaborators assigned to an investigation from an individual investigation or from the Investigations dashboard.

  • Hover over the collaborator icons to see the names of the collaborators on your investigation.
  • If a collaborator does not have write permissions for an investigation, the icon is gray and (read-only) is appended to their name.
  • Click the icon of a collaborator to see information about them. See their name and the permissions that the user has for the investigation.

This screen image shows the name and permissions options that show when you click a collaborator icon.

Make changes to the collaborators on an investigation

If you are a collaborator on an investigation with write permissions, you can change the permissions of other collaborators on the investigation.

  1. Click the icon of a collaborator.
  2. Change the Write permissions. By default, all collaborators have Yes for Write permissions. All investigations must have at least one collaborator with write permissions.

You can remove a collaborator if they are not the only collaborator on the investigation with write permissions.

  1. Click the icon of a collaborator.
  2. Click Remove.
PREVIOUS
Make changes to an investigation in Splunk Enterprise Security
  NEXT
Review an investigation in Splunk Enterprise Security

This documentation applies to the following versions of Splunk® Enterprise Security: 4.7.0, 4.7.1, 4.7.2, 4.7.3, 4.7.4, 4.7.5, 4.7.6


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters