Effective permissions to allow a role to delete artifacts and events

Applicability

Splunk SOAR

Description

Finding out how to set specific permissions to allow a user to DELETE artifacts and events only.

Investigation

Steps Reproduce:

AS ADMIN: 

1. Go into ADMINISTRATION -> USER MANAGEMENT -> ROLES AND PERMISSIONS -> Select "CSOC Orchestration Engineer" role. 
2. In BASIC PERMISSONS tab, select/enable the EVENTS DELETE, EDIT AND VIEW 
3. In LABEL PERMISSIONS tab, select/enable DELETE, EDIT AND VIEW for each label where I want the user to be able to delete artifacts and events from. 
4. Save the changes 
5. LOGIN as my named account user, and create an event with a label that I have delete perms on. 
6. Add an artifact with a few values in it. 
7. Now attempt to delete that very same artifact I just created and the DELETE button is greyed out. 
8. Now attempt to delete that very same event I just created and the DELETE button is greyed out. 

It seem like there is something missing in the role permissions.

The documentation is not that detailed so we are unable to explain what is missing. 

Troubleshooting:

1. Tried to refresh the browser.

2. Tried to create a new local account with a new role using the same permission.

• Created a new local account called TEST1 
• Then added the CSOC ORCHESTRATOR role to the TEST1 user, and the user could not delete artifacts or events. 
• Created a new role called TEST1ROLE 
• Set the permissions of the TEST1ROLE to be exactly the same as the CSOC ORCHESTRATOR role. 
• The user was able to delete artifacts and events. 
• Changed the TEST1 user role back to CSOC ORCHESTRATOR, and the user could not delete artifacts or events. 
• So this kind of hints at a parsing/enforcement issue with the existing CSOC ORCHESTRATOR role, for some reason. 

3. To check the rest API for both roles:
 

https://<phantom_ip>/rest/role/<TEST1ROLE_ID>
https://<phantom_ip>/rest/role/<CSOC_ORCHESTRATOR_ID>

To get the Role ID, the easiest is to go to that particular role configuration and in the URL you will find the integer number at the end of the URL path. That is the Role ID. 
Otherwise, you can list all the Role with https://<phantom_ip>/rest/role, here you will find the id in the JSON file for each role.

See if there is any difference in the JSON file configuration. 

4. Looks like the CSOC Orchestrator Role JSON output is a bit larger. 

5. There is a configuration in CSOC Orchestrator Role where the tenant nabCERT CSOC deny the delete. This is the issue not allowing the user to delete.
 

{
"execute": "deny",
"name": "tenant",
"extra": "nabCERT CSOC",
"edit": "allow",
"object_id": 1,
"role": 8,
"content_type": 20,
"delete": "deny",
"id": 66,
"view": "allow"
}

Resolution

Change the CSOC Orchestration Engineer Role to allow deny for nabCERT CSOC role:
 

{
"execute": "deny",
"name": "tenant",
"extra": "nabCERT CSOC",
"edit": "allow",
"object_id": 1,
"role": 8,
"content_type": 20,
"delete": "allow",
"id": 66,
"view": "allow"
}

 

Revision History

Revision	Publish Date	Comments
1.0	28-Sep-2026	Initial Release