Assigning A Profile to Role/User

[MichailPiskoun]

Is there a way to assign a Profile in the investigation tab to a specfic role, or user? That way when the specific role/user goes into the investigation view they will only see meta for that Profile view.

If so, how?

[GuyBruneau · Accepted solution]

Michail,

One way you could do that is under the user account, in the Attributes tab, add in the SA Core Query Prefix box the meta query you want the account to query when it opens the investigation tab (it applies to Events tab as well). The query prefix needs to look like any query that would be performed in either tab such as ioc = "rig exploit kit"

Hope this helps,

Guy

[MichailPiskoun]

Thanks Guy, that did the trick.