Users assigned a custom role in Splunk Enterprise Security cannot see Findings or Investigations

Applicability

Description

When a custom role is created in Splunk Enterprise Security (ES) and assigned capabilities equivalent to built-in roles such as ess_user or ess_analyst, users may still be unable to view Findings and Investigations in the Analyst Queue dashboard.

Common symptoms include:

• Analyst Queue displays “Waiting for data…”

• Message “Search did not return any findings or investigations”

• No results displayed despite existing Findings/Investigations

In Splunk ES, the Analyst Queue relies on underlying searches i.e. Incident Review - Main that read and enrich data from KV Store collections, including:

• mc_incidents

• ers_lookup

By default, only ES out-of-the-box roles (such as ess_user, ess_analyst) are explicitly granted read access to these KV Store collections.

Custom roles are not automatically added to the access control lists (ACLs) for these collections, even if:

• The custom role inherits from ess_user or ess_analyst

• The role is added to the enforce_es_permissions setting

As a result, users assigned only the custom role cannot retrieve the required data and see empty results in the Analyst Queue.

Resolution

Steps to grant read access to the required KV Store collections for the custom role.:

1. Navigate to Settings → All configuration

2. Search for mc_incident Collection

3. Click Permissions for mc_incidents (collections-conf config type)
   

4. Grant Read permission to the custom role and save:
   

5. Return to Settings → All configuration

6. Search for ers_lookup Collection

7. Click Permissions for mc_incidents (collections-conf config type)
   
8. Grant Read permission to the custom role and save:
   
9. Log in as a user assigned to the custom role and navigate to Enterprise Security → Analyst Queue. Confirm that Findings and Investigations are displayed as expected.