SPLK-2003 · Question #94
Some of the playbooks on the SOAR server should only be executed by members of the admin role. How can this rule be applied?
The correct answer is A. Make sure the Execute Playbook capability is removed from all roles except admin.. To restrict playbook execution to members of the admin role within Splunk SOAR, the 'Execute Playbook' capability must be managed appropriately. This is done by ensuring that this capability is removed from all other roles except the admin role. Role-based access control (RBAC) i
Question
Some of the playbooks on the SOAR server should only be executed by members of the admin role. How can this rule be applied?
Options
- AMake sure the Execute Playbook capability is removed from all roles except admin.
- BPlace restricted playbooks in a second source repository that has restricted access.
- CAdd a filter block to all restricted playbooks that filters for runRole = "Admin".
- DAdd a tag with restricted access to the restricted playbooks.
How the community answered
(36 responses)- A83% (30)
- B3% (1)
- C3% (1)
- D11% (4)
Explanation
To restrict playbook execution to members of the admin role within Splunk SOAR, the 'Execute Playbook' capability must be managed appropriately. This is done by ensuring that this capability is removed from all other roles except the admin role. Role-based access control (RBAC) in Splunk SOAR allows for granular permissions, which means you can configure which roles have the ability to execute playbooks, and by restricting this capability, you can control which users are able to initiate playbook runs.
Topics
Community Discussion
No community discussion yet for this question.