XSIAM V3.4 upgrade - anyone having issues?

[PA_nts]

Having reports from xsiam engineers/analysts that some cases are not visible in xsiam.. one particular case detail is fortinet cases where the 'case name = utm:ips signature' 

anyone seen similar to date?

[MarekKreul]

We've noticed exactly the same issue, only instance admins can currently see all cases. However we have not yet seen any common fact on the cases that can't be seen by the normal analysts. We have a highest-Prio support case open since yesterday evening, as this highly impacts our SOC.

[PA_nts]

Thanks for the response..

to confirm have you noticed this on any other tickets or only Forti related cases?

yes forgot to mention in my case also, i am instance admin and i can see the case also.. our Analysts and other users (non instance admin) are affected 

i also have a TAC open.. will post response / solution from PAN if and when received.

appreciated

[TobiasHahn · Accepted solution]

Hello,

with 3.4 a new option was added to the "Assets" part of the Scope Based Access control:

Allow access to cases and issues that are not referencing known assets or endpoints.

You might need to check this for your users/roles/user groups even if you are not using any scope based limitations. Activating this option restored the missing access for our users (although they did not have any SBAC limitations before). 

[PA_nts]

thanks TobiasHahn - that fixed it 🙂