Following the installation of ES, an admin configured users with the ess_user role the ability to close notable events. How would the admin restrict these users from being able to change the status…

Question

Options

• AIn Enterprise Security, give the ess_user role the Own Notable Events permission.
• BFrom the Status Configuration window select the Closed status. Remove ess_user from the status
• CFrom the Status Configuration window select the Resolved status. Remove ess_user from the
• DFrom Splunk Access Controls, select the ess_user role and remove the edit_notable_events

• A
  14% (5)
• B
  8% (3)
• C
  53% (19)
• D
  25% (9)

Explanation

Option C is correct because in Splunk Enterprise Security's Status Configuration, permissions are controlled on the source status - the one a user is transitioning away from. To block the Resolved → Closed transition, you must remove ess_user from the Resolved status configuration, which revokes their ability to move events out of that state.

Why the distractors are wrong:

• A is wrong - the "Own Notable Events" permission controls ownership of events, not status transition rights; it doesn't restrict which transitions a role can perform.
• B is wrong - configuring the Closed status would restrict who can transition out of Closed (e.g., Closed → something), not who can transition into it from Resolved.
• D is wrong - removing edit_notable_events entirely is a sledgehammer approach that would strip all notable event editing, not just the specific Resolved → Closed transition.

Memory tip: Think "lock the door you're leaving, not the one you're entering." Status Configuration permissions govern the role's ability to leave a status, so always select the originating status (Resolved) to block a specific transition.

No community discussion yet for this question.