I wonder who within Incident Review can assign incidents to the group members? Does anybody can assign them?
https://docs.splunk.com/Documentation/ES/5.3.1/Install/ConfigureUsersRoles
Look at edit notable events.
https://docs.splunk.com/Documentation/ES/5.3.1/Install/ConfigureUsersRoles
Look at edit notable events.