I am interested in allowing a limited number of network users to access specific Windows events. The network users are currently members of a "company_user_network" role. I would like to create a second role for the purpose of assigning access to the subset of Windows events.
Role: company_wineventsubset_user
restrict search terms: eventtype=wineventsubset
inherited roles:
indexes searched by default: All non-internal indexes
restrict access to index: wineventlog
Role: company_user_network
inherited roles: user
indexes searched by default: firewall, network, vpn, web
restrict access to index: firewall, network, vpn, web
User: user_test
selected roles: company_user_network, company_wineventsubset_user
I have attempted using the above configurations. Unfortunately, the "restrict search terms: eventtype=wineventsubset" is being applied to both roles, not just the "company_wineventsubset_user" role. Is this correct? Is there a different way that access can be restricted to a subset of the Windows event logs while still allowing full access to the other indexes listed in the role?
Thank you.
Looks like an inheritance issue. Define the new role and select the capabilities for that role manually. 🙂
Looks like an inheritance issue. Define the new role and select the capabilities for that role manually. 🙂
I believe that that is what was done.
Please choose "Accept Answer" if this was your solution so that your question is marked as resolved.