Users with a custom role receive a bad request error when changing an investigation status in Splunk Enterprise Security 8.x

Applicability

Description

When an affected user changes the status of an investigation, Splunk Enterprise Security displays a bad request message. This happens for every target status, whether intermediate or final. In the browser developer tools, the failed request may show blank Response and Preview tabs, so no further detail is visible. The same users can still open investigations, view findings, and make edits that do not change the status, such as updating the
owner or urgency. Users whose roles inherit a default Enterprise Security role, such as ess_analyst, can change the same statuses without an error. 

Splunk Enterprise Security permits each status transition, from one status to another, per role. On the Statuses page, the Transitions section of each status lists two kinds of roles.
- Roles that are explicitly selected.
- Roles marked "(inherited)". These roles receive the transition because they inherit from a selected role.

A custom role that is not selected, and that does not inherit from any selected role, does not appear in either group. Users who hold only that role cannot perform the transition.

This commonly happens when a custom role inherits from other custom roles, or from Mission Control roles such as mc_admin or mc_analyst, but not from ess_analyst.

Investigation

Required permissions: A user with administrative access to Enterprise Security configuration, for example a role that inherits ess_admin or sc_admin.

1. Confirm the scope. Ask an affected user to make an edit that does not change the status, such as changing the owner of the investigation. Expected result: The edit saves, but a status change still
   fails. If all edits fail, this article does not apply.

2. Identify a comparison user who can change the status of the same investigation. Record that user's roles.

3. In Splunk Web, go to Settings, then Roles. Open the affected user's role and record every inherited role, all the way up the inheritance chain.

4. In Splunk Enterprise Security, go to Configure, then Findings and investigations, then Statuses.

5. Locate the status the investigation is currently in. Select the pencil icon in the Actions column to edit it.

6. In the Transitions section, expand the transition to the target status. Record which roles are explicitly selected and which roles are marked "(inherited)".

7. Compare the lists. Expected result: The comparison user's role, or a role it inherits from, appears on the transition. None of the affected user's roles appear. This confirms the cause.

Resolution

Choose one of the following options. Option 1 is recommended. 

Option 1. Add the custom role to the transitions (recommended)

1. In Splunk Enterprise Security, go to Configure, then Findings and investigations, then Statuses.
2. Select the pencil icon in the Actions column for an enabled status.
3. In the Transitions section, add the custom role to every transition that its users need to perform. Select Save. 4. Repeat steps 2 and 3 for each enabled status that the users need to move investigations out of.
5. Wait about three minutes for the change to take effect.
6. Ask an affected user to log out, log back in, and retry the status change. Expected result: The status updates and no bad request error is shown.
7. If the change is still rejected after a few more minutes, remove the custom role from the transition and select Save. Add the role back, select Save again, and retry. Adding the role directly lets administrators control exactly which status changes the custom role can make, in line with least-privilege access.

Option 2. Configure the custom role to inherit ess_analyst

1. In Splunk Web, go to Settings, then Roles.
2. Edit the custom role, or a role it inherits from, and add ess_analyst to its inherited roles. Select Save.
3. Ask an affected user to log out, log back in, and retry the status change.

Note: This option also grants every other capability that ess_analyst holds. Review it with your access control owners before applying it.

Validation
- Affected users can change investigation status to each required status without an error.
- On the Statuses page, the custom role appears on the required transitions, either as selected or as "(inherited)".

Related Links

- Splunk Enterprise Security 8 documentation