Splunk® Intelligence Management (Legacy)

User Guide

Acrobat logo Download manual as PDF


Acrobat logo Download topic as PDF

Add, edit, and remove users from Splunk Intelligence Management

Any user in Splunk Intelligence Management station with the role of company administrator can create, delete, and manage users. You can create multiple company administrator accounts to share user management tasks.

Access user management

To access the Users panel where you can manage your organization's users, click the User Settings icon in the navigation bar, then select Settings on the popup menu.

The list of all users, including information about each user, is displayed.

Add a new user to Splunk Intelligence Management

To add a user, follow these steps:

  1. Click Add User in the User Management panel.
  2. Enter the user's information in the Add User window:
    Section Options and description
    Basic Information
    • First and Last Name
    • Email Address
    Role Choose one of the following:
    • User
    • Company Administrator
    Enclave Permissions Depending on the type of enclave, you can set up:
    • No View: User will not see enclave at all in their view of Splunk Intelligence Management Station.
    • View Only: User can only see data in the enclave, no edit permissions granted.
    • Submission Access: User can view data and also submit new data into the enclave.
    • Full Access: User has permission to view and edit data within the enclave.
    MFA Enabled If your company has set up multi-factor authentication (MFA), then you can enable this setting.
  3. When you are finished setting up the user, click Save User.

To quit setting up a new user without saving the information, just click outside the window and it will automatically close and return you to the User Management panel.

Reset a user's password

To force a password reset for a user, locate the user in the list and then click Reset Password in the Information column for that user.

This action sends a password reset email to the user, with a link they can use to start the reset process.

If users are not receiving reset password emails, check that your email system is not classifying them as spam emails. Splunk Intelligence Management uses the following IPs to send emails:

  • 52.38.235.132
  • 52.26.188.119
  • 35.163.241.94
  • 35.163.237.243

Edit user permissions

To edit the information or permissions for a user:

  1. Click the pencil icon on the right side of their information.
  2. Make any desired changes in the Edit User window.
  3. Click Save User.

Export the list of users

To export the entire list of users, click the Export All button next to the Users search box. This will download the list of users in .csv format.

Deactivate a user

To deactivate a user, click the person icon on the right side of their information.

To activate a user that you have previously deactivated, click the person icon.

You can also deactivate or activate a user from the Edit User window.

Delete a user

To delete a user, click the trashcan icon on the right side of the user's information.

You can also delete a user from the Edit User window.

Last modified on 21 April, 2022
PREVIOUS
Set up an enclave inbox with ProofPoint
  NEXT
Configure the company safelist to ignore certain indicators

This documentation applies to the following versions of Splunk® Intelligence Management (Legacy): current


Was this documentation topic helpful?


You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters