Restrict users to see incidents

[GirishBabuK]

I have one requirement that if u_incident_type is security, and assignment_group is SOC then those incidents should be visible to only the people who has the role Splunk-Access.

Kindly suggest me

[SN_Learn]

Hi @GirishBabuK ,

You can create a read ACL with the below script in incident table.

if(current.assignment_group == 'sys_id_of_SOC_group' && current.u_incident_type == 'Security'){
answer = gs.hasRole('Splunk_Access');
}

 Replace with the correct sysIds.

Note: The best practice will be to store the sysID of group in a system property and call it as below:

gs.getProperty('<property_name>'); 

Mark this as Helpful / Accept the Solution if this helps

[GirishBabuK]

this is not working

[James Chun]

Hi @GirishBabuK,

You can use the Data Filtration capability - https://docs.servicenow.com/bundle/washingtondc-platform-security/page/administer/security/concept/d...

Should be pretty easy to set one up.

Cheers

[Dr Atul G- LNG]

Hi @GirishBabuK 

You can use ACL as well for this.