Description

In the dashboards, user activity data (i.e. "Activity & History" perspective) is linked to the “Manage credentials” capability. This is irrelevant, as the data displayed is linked to user activity. So it's the “Access security activity” capability that should define whether or not we're allowed to see it.

Environment

OCTI 6.3.9

Reproducible Steps

Steps to create the smallest reproducible scenario:

1. Create a user with this capabilities (and all marking allowed)

2. Log in with this new user

3. Create Custom Dashboard

4. Create Widget → List (Distribution) → Activity and History (no filter, all default parameter)
   -> "You are not authorized to see this data"

5. With an admin user, add the capability “Manage credentials” to the newly created user

6. With the newly created user, refresh the dashboard page
   -> Now you have data in your widget

Expected Output

I hope to see the data if I have the “Access security activity” capability (and not based on “Manage credentials”)

Actual Output