Roles

The roles and their capabilities in Alert Manager Enterprise are displayed in the table below.

Capability	Splunk Admin Role	AME Admin Role	AME Power User	AME User
Application
App installation	✅	❌	❌	❌
App update	✅	❌	❌	❌
AME setup	✅	❌	❌	❌
AME update tasks	✅	✅	❌	❌
AME configuration (license, logging, proxy)	✅	❌	❌	❌
Events
View events	✅	✅	✅	✅
Add and view comments to existing events	✅	✅	✅	✅
View the count, history and result fields	✅	✅	✅	✅
Filter events by time range	✅	✅	✅	✅
Filter events by tag	✅	✅	✅	✅
Search events by priority	✅	✅	✅	✅
Invoke Splunk Workflow Actions	✅	✅	✅	✅
Modify events	✅	✅	✅	❌
Assign a user to an event	✅	✅	✅	❌
Update the notification scheme	✅	✅	✅	❌
Update the status of an event	✅	✅	✅	❌
Update the urgency of an event	✅	✅	✅	❌
Edit multiple events at the same time	✅	✅	✅	❌
Update the status of an event	✅	✅	✅	❌
Tag an event with MITRE ATT&CK or CYBER kill-chain	✅	✅	✅	❌
Start the search that created the event	✅	✅	✅	❌
Delete events	✅	✅	❌	❌
Templates
Apply template on alert action	✅	✅	✅	✅
Create template	✅	✅	✅	❌
Update template	✅	✅	✅	❌
Delete template	✅	✅	✅	❌
Rules
Set rules to suppress alerts concerning an event	✅	✅	✅	❌
Set conditions for an event to become automatically resolved	✅	✅	✅	❌
Delete status	✅	✅	✅	❌
Set time restrictions for rules to be applied	✅	✅	✅	❌
Tags
Create tags	✅	✅	✅	❌
Update tags	✅	✅	✅	❌
Delete tags	✅	✅	✅	❌
Update predefined MITRE ATT&CK© tags	✅	✅	✅	❌
Tenants
Create tenants	✅	✅	❌	❌
Configuration templates available	✅	✅	❌	❌
Delete uninitialized tenants	✅	✅	❌	❌
Test HEC Connectivity	✅	✅	❌	❌
Initialize tenants with the corresponding event collection and roles	✅	❌	❌	❌
Delete initialized tenants	✅	❌	❌	❌
Notifications
Assign a status to an event that will trigger the notifications specified in the events notification scheme	✅	✅	✅	❌
Configure notifications on status change	✅	✅	❌	❌
Statuses
Create statuses	✅	✅	❌	❌
Update statuses	✅	✅	❌	❌
Delete statuses	✅	✅	❌	❌
Set description for statuses	✅	✅	❌	❌
Resolutions
Create resolution	✅	✅	❌	❌
Update resolution	✅	✅	❌	❌
Delete resolution	✅	✅	❌	❌
Set description for resolutions	✅	✅	❌	❌
SLAs
Create SLA	✅	✅	❌	❌
Update SLA	✅	✅	❌	❌
Delete SLA	✅	✅	❌	❌