A newly built custom dashboard needs to be available to a team of security analysts in ES. How is it possible to integrate the new dashboard?

Question

Options

• ASet the dashboard permissions to allow access by es_analysts and use the navigation editor to
• BAdd the dashboard to a custom add-in app and install it to ES using the Content Manager.
• CAdd links on the ES home page to the new dashboard.
• DCreate a new role inherited from es_analyst, make the dashboard permissions read-only, and

• A
  80% (28)
• B
  3% (1)
• C
  6% (2)
• D
  11% (4)

Explanation

Option A is correct because the proper way to integrate a custom dashboard into Splunk Enterprise Security (ES) for a specific team is a two-step process: set the dashboard's permissions to share it with the es_analyst role, then use ES's Navigation Editor to add the dashboard to the analyst's navigation menu. This makes it natively accessible within the ES app context.

Why the distractors are wrong:

• B is incorrect because the Content Manager is used for importing ES content packs and add-ons, not for surfacing individual custom dashboards to user groups.
• C is incorrect because adding links on the ES home page is a cosmetic workaround - it doesn't properly grant role-based access or integrate the dashboard into the ES navigation structure.
• D is incorrect (and incomplete as written) because creating a new inherited role is unnecessary overhead; the existing es_analyst role can simply be granted permission directly on the dashboard without creating role inheritance chains.

Memory tip: Think "Permission + Navigation = Integration." In Splunk ES, making something available to a role always requires both setting who can see it (permissions) and where they see it (Navigation Editor). If an answer only addresses one of those two steps, it's incomplete.

No community discussion yet for this question.