Assign roles for Splunk App for SOAR

Assign specific roles to administer and view data in Splunk App for SOAR.

Roles for Splunk App for SOAR

The following roles are associated with Splunk App for SOAR, Splunk Enterprise, and Splunk Cloud Platform. Information on assigning the roles appears after this table.

Role name	Description	User type
admin	Used to write to the appropriate files to configure Splunk App for SOAR to work with Splunk Enterprise and Splunk Cloud Platform. The admin role includes the following capabilities: splunk_app_soar_read splunk_app_soar_write admin_all_objects, used to make modifications to Splunk App for SOAR	Administrator
splunk_app_soar_dashboards	Enables a nonadministrative user to view Splunk App for SOAR dashboards.	Nonadministrative user

Add the splunk_app_soar and splunk_app_soar_dashboards roles to users on Splunk Enterprise

Perform the following steps to add the splunk_app_soar role to the Splunk user setting up the Splunk App for SOAR in supported Splunk Enterprise environments and add the splunk_app_soar_dashboards role to a nonadministrative user:

1. Navigate to the Splunk platform instance where you installed Splunk App for SOAR.
2. In Splunk Web, select Settings. In the Users and Authentication section, select Roles.
3. Assign the splunk_app_soar role to a user or role. For example, if you want the Analyst role to have Splunk SOAR capabilities, perform these steps:
   1. For the Analyst role, in the Actions column, select Edit.
   2. In the Inheritance tab, select the check box next to the splunk_app_soar role. This will cause all users with the admin role to also inherit all privileges from the splunk_app_soar role.
4. Repeat the previous steps for the nonadministrative splunk_app_soar_dashboards role and any other roles.
5. Select Save.

For additional information on adding roles in Splunk Enterprise, see Add or edit a role in the Securing Splunk Enterprise manual.

When inheriting a role, the inheritance works for one level only. For example, the splunk_app_soar_dashboards role might be inherited by the Analyst role, which in turn is inherited by the User role. The Analyst role would have the splunk_app_soar_dashboards capabilities, but the User role would not, because it is more than one level away from the splunk_app_soar_dashboards role.

Add the splunk_app_soar and splunk_app_soar_dashboards roles to users on Splunk Cloud Platform

To add the splunk_app_soar role to the Splunk user setting up the Splunk App for SOAR in supported Splunk Enterprise environments and add the splunk_app_soar_dashboards role to a nonadministrative user, follow the instructions in Add or edit a role in the Securing Splunk Cloud Platform manual.

When inheriting a role, the inheritance works for one level only. See detailed note about inheritance in the previous section.