Configure role based access control inside Splunk Phantom apps

Phantom supports granular asset access control inside of Splunk Phantom apps to ensure that only authorized access to the app is allowed. Asset access control works on an authorized basis, with a default-deny policy.

When granular asset access control is enabled, only users or groups with explicit permissions are able to perform actions in a Splunk Phantom app. Configure user and group permissions on all configured apps before enabling granular asset access control.

The following example shows how to set up a user for a single permission on the Phantom DNS app.

1. From the Main Menu, select Apps.
2. Click 1 configured asset to expand the section.
3. Click Google DNS to edit the asset.
4. Click the Access Control tab.
5. Click Edit.
6. Select lookup domain from the App Action drop-down list.
7. Select the user Herman Smith and click the right arrow in order to move this user into the Approved Users and Roles area as shown in the following image:
   
8. Click Save.

With your app configured for this role, you can now enable granular asset access control so that these permissions take effect.

1. From the Main Menu, select Administration.
2. Select User Management > Asset Permissions.
3. Check the Enable granular Asset Access Control checkbox.
4. Confirm that you want to change global asset permissions.
5. Click Save Changes.