The Splunk App for SOAR Export requires that specific roles are added for the Splunk user setting up the Splunk App for SOAR Export. Add the phantom and ess_user roles to users on Splunk Enterprise ...
- RBAC/Users collection OFF by default (use -Rbac to enable) - Usage analytics collection OFF by default (use -Usage to enable) ...