Hi,

I have some users who should only be able to see the results of two particular saved searches - either as a pulse dashboard or somehow in the log-tab. Is it possible?

Thanks and best regards!

Hi Uta,

I would spontaneously answer the question with "yes". QRadar offers a number of options for implementing your question in this way. Both as a Pulse Dashboard or as a saved search or both..

Depends on what skills and hands-on experience you have. The question wasn't whether it could be done easily or with just 2 clicks :)

Regards,

Ralph

Hi Ralph,

thanks for your reply. I don't expect it to be done by two clicks, but some users should only be able to see two of e.g. ten pulse-dashboards. I can "allow" them to see pulse-dashboards in general, but I did not find any possibilty to make them only see the particular two. So any suggestion would be appreciated.

Regards,

Uta

Hi Uta,

as a first simple approach, I would for example prepare the dashboard as it should be and then use the "share" action to send the URL to the appropriate user via email.

Regards,

Ralph

Hi Ralph,

the dashboard already exists. If I send the email the dashboard is added to the existing dashboards. That's not what I want...

Maybe I need to clarify: I have some users who should ONLY see the results of two different searches. If they log in to QRadar, these two searches should be available to them - and ONLY these, nothing around, no other searches or pulse dashboards.

Regards,

Uta

Hi Uta,

depending on the role of the user, the question arises for which use case the analyst only needs this limited information. If as an analyst only these two results are needed in QRadar, perhaps another option of providing these results should be considered. E.g. as a report and e-mail delivery.

From my experience, this "extreme" limitation of searches and dashboards can only be set manually or customized in the user context...

Regards,

Ralph

Hi Ralph,

export or mail is no option - realtime-data is needed. For privacy-reasons I won't explain the use case in detail.

I also have some years of QRadar-experience - but what exactly do you mean by "set manually" or "in the user context"? Of course it has to be realized in the user context - but how?

Regards,

Uta

Hi Uta,

for example to edit every saved search option "include in my quick searches" manually and deselect or select to just see in the quick search pulldown in the log activity tab what you want to see in this user context...

Regards,

Ralph

Hi Ralph,

​

I'm aware of this possibility - but do you want to do that manually for more than at least 100 saved searches? I don't ;-).

I am looking for another way ....

Regards,

Uta

Hi Uta,

another option is to raise a RFE in the ideas portal. I will vote for it :)

Regards,

Ralph

Hi Uta,

Or you provide those useres an API Script calling the saved searches...

Regards,

Ralph

... RFEs take too long - if they are ever being implemented ...

The result must be easy to use - scripts are no option.

So probably not that easy ... ;-)

Have a nice weekend!

Regards,

Uta

Hi Uta,

i agree. But at the other hand driving for an example a F1 Racing Car is although not that easy to drive, even you maybe have 30 years experience driving a car :)

Nice discussion :)

Have a nice weekend too!

Regards,

Ralph