Provide Access to the Quarantine Workload Action
By default, users do not have access to the Quarantine Workload action either in the Splunk App or in Adaptive Response Action.
To enable a Splunk user to take quarantine actions on Workloads, grant the user the Illumio_quarantine_workload role and the admin role. Only local users can be granted this role. SAML users cannot, because their roles are controlled by an external system.
Click Settings > Access Control.
Click Users.
Click the username to which the role needs to be granted.
In the Role section of the edit screen, grant the required roles.
Click Save.