-
Notifications
You must be signed in to change notification settings - Fork 1
/
default.meta
134 lines (95 loc) · 4.02 KB
/
default.meta
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
# Application-level permissions
# https://dev.splunk.com/enterprise/docs/developapps/manageknowledge/setpermissionsforobjects/
# https://dev.splunk.com/enterprise/docs/planapps/cloudready
# Apply this default.meta to all apps owned by Security
[]
export = none
access = read : [ sc_admin , es_security_content_manager ], write : [ sc_admin, es_security_content_manager ]
[alert_actions]
export = none
owner = es_security_content_owner
access = read : [ sc_admin , es_security_content_manager ], write : [ sc_admin, es_security_content_manager ]
[app]
export = none
owner = es_security_content_owner
access = read : [ sc_admin , es_security_content_manager ], write : [ sc_admin, es_security_content_manager ]
[commands]
export = none
owner = es_security_content_owner
access = read : [ sc_admin , es_security_content_manager ], write : [ sc_admin, es_security_content_manager ]
## To set permissions for a data model, you must include a stanza for both models and datamodels object types
[models]
export = none
owner = es_security_content_owner
access = read : [ sc_admin , es_security_content_manager ], write : [ sc_admin, es_security_content_manager ]
[datamodels]
export = none
owner = es_security_content_owner
access = read : [ sc_admin , es_security_content_manager ], write : [ sc_admin, es_security_content_manager ]
###
[eventtypes]
export = none
owner = es_security_content_owner
access = read : [ sc_admin , es_security_content_manager ], write : [ sc_admin, es_security_content_manager ]
[html]
export = none
owner = es_security_content_owner
access = read : [ sc_admin , es_security_content_manager ], write : [ sc_admin, es_security_content_manager ]
[lookups]
export = none
owner = es_security_content_owner
access = read : [ sc_admin , es_security_content_manager ], write : [ sc_admin, es_security_content_manager ]
[macros]
export = none
owner = es_security_content_owner
access = read : [ sc_admin , es_security_content_manager ], write : [ sc_admin, es_security_content_manager ]
[nav/default]
export = none
owner = es_security_content_owner
access = read : [ sc_admin , es_security_content_manager ], write : [ sc_admin, es_security_content_manager ]
[savedsearches]
export = none
owner = es_security_content_owner
access = read : [ sc_admin , es_security_content_manager ], write : [ sc_admin, es_security_content_manager ]
[searchscripts]
export = none
owner = es_security_content_owner
access = read : [ sc_admin , es_security_content_manager ], write : [ sc_admin, es_security_content_manager ]
[views]
export = none
owner = es_security_content_owner
access = read : [ sc_admin , es_security_content_manager ], write : [ sc_admin, es_security_content_manager ]
[tags]
export = none
owner = es_security_content_owner
access = read : [ sc_admin , es_security_content_manager ], write : [ sc_admin, es_security_content_manager ]
[visualizations]
export = none
owner = es_security_content_owner
access = read : [ sc_admin , es_security_content_manager ], write : [ sc_admin, es_security_content_manager ]
[searchbnf]
export = none
owner = es_security_content_owner
access = read : [ sc_admin , es_security_content_manager ], write : [ sc_admin, es_security_content_manager ]
[restmap]
export = none
owner = es_security_content_owner
access = read : [ sc_admin , es_security_content_manager ], write : [ sc_admin, es_security_content_manager ]
[props]
export = none
owner = es_security_content_owner
access = read : [ sc_admin , es_security_content_manager ], write : [ sc_admin, es_security_content_manager ]
[transforms]
export = none
owner = es_security_content_owner
access = read : [ sc_admin , es_security_content_manager ], write : [ sc_admin, es_security_content_manager ]
### VIEWSTATES: even normal users should be able to create shared viewstates
[viewstates]
access = read : [ * ], write : [ * ]
export = none
owner = es_security_content_owner
### On Prem Only
[manager/accesscontrols]
export = none
owner = es_security_content_owner
access = read : [ sc_admin , es_security_content_manager ], write : [ sc_admin, es_security_content_manager ]