A user role is a set of role permissions. A role permission grants an administrator the ability to perform certain actions -- e.g., add or remove an attachment from an existing incident, create a triggered alert rule, create or close an incident, etc. Roles are assigned to administrator profiles, which are, in turn, assigned to administrators. For more details on creating administrators and administrator profiles, see the section Administrators.
To create a role and assign certain permissions to it, follow these steps:
|
Name |
Description |
|---|---|
|
Step 1. Create a role. |
In the User roles section, click Add and provide a name and description for the new role. |
|
Step 2. Add the desired permissions to the role just created. |
In the Role permissions section, select the desired permission, and click Add to add it to the role created earlier. |
The following role permissions can be added for users:
|
Name |
Description |
|---|---|
|
Assignable user |
Users with this permission may be assigned to incidents. An assignee can be added during the creation or editing of an incident. |
|
Assign incidents |
The ability to assign incidents to other people. An assignee can be added during the creation or editing of an incident. |
|
Close incidents |
The ability to close an incident. It can often be a useful arrangement when developers resolve incidents and testers close them. You can close an incident in the Incidents ➜ tab, where N is the ordinal number of the incident. An incident can only be closed from the states for which a transition to the "Closed" state is configured in the incident schema. For more details, see Incident Settings. |
|
Create incidents |
The ability to create incidents. Incidents can be created manually in the Incidents ➜ Incidents log tab or automatically when an analytics rule is triggered. For more details on how to create incidents, see the section Creating Security Incidents. |
|
Edit incidents |
The ability to edit incidents. You can edit an incident in the Incidents ➜ tab, where N is the ordinal number of the incident. For more details, see the section Incident Details. |
|
Reopen incidents |
The ability to reopen incidents. You can reopen an incident in the Incidents ➜ tab, where N is the ordinal number of the incident. |
|
Edit watchers |
The ability to add and remove watchers. Incident watchers can be added during the creation or editing of an incident. |
|
Add comments |
The ability to comment on incidents. You can comment on an incident in the Incidents ➜ tab, where N is the ordinal number of the incident, in the Activity section. |
|
Delete all comments |
The ability to delete any comments made on incidents. You can view the comments for an incident in the Incidents ➜ tab, where N is the ordinal number of the incident, in the Activity section. |
|
Delete own comments |
The ability to delete own comments made on incidents. You can view the comments for an incident in the Incidents ➜ tab, where N is the ordinal number of the incident, in the Activity section. |
|
Edit all comments |
The ability to edit all comments made on incidents. You can view the comments for an incident in the Incidents ➜ tab, where N is the ordinal number of the incident, in the Activity section. |
|
Edit own comments |
The ability to edit own comments made on incidents. You can view the comments for an incident in the Incidents ➜ tab, where N is the ordinal number of the incident, in the Activity section. |
|
Create attachments |
The ability to create attachments to incidents. Attachments can be added to an incident in the Incidents tab during the creation or editing of the incident. The attachments are displayed in the Incidents ➜ tab, where N is the ordinal number of the incident, in the Attachments section. |
|
Delete all attachments |
The ability to delete all attachments. The incident's attachments are displayed in the Incidents ➜ tab, where N is the ordinal number of the incident, in the Attachments section. |
|
Delete own attachments |
The ability to delete own attachments. The incident's attachments are displayed in the Incidents ➜ tab, where N is the ordinal number of the incident, in the Attachments section. |
|
Edit observables |
The ability to create and edit observables. Observables can be added in the Incidents ➜ tab, where N is the ordinal number of the incident, in the Observables section. For more details on observables, see the section Incident Details. |
|
Update enrichments |
The ability to update observables' enrichments. The list of external enrichment services is available under Libraries ➜ External enrichment services on the Settings tab. For more details on external enrichment services, see the section External Enrichment Services. |
|
Generate report |
The ability to generate and download/send reports. Incident reports can be created in the Incidents ➜ tab, where N is the ordinal number of the incident. For more details, see the section Incident Details. |
|
Add triggered alerts/logs to incident |
The ability to add triggered alerts/logs in to the incident. Logs can be added in the Incidents ➜ tab, where N is the ordinal number of the incident, in the Logs section. For more details on logs and triggered alerts, see the sections Analytics Search and Triggered Alerts, respectively. |
|
Remove all triggered alerts/logs from incident |
The ability to remove all triggered alerts/logs from the incident. Triggered alerts and logs are displayed in the Incidents ➜ tab, where N is the ordinal number of the incident, in the Triggered alerts and Logs sections, respectively. For more details on logs and triggered alerts, see the sections Analytics Search and Triggered Alerts, respectively. |
|
Remove own triggered alerts/logs from incident |
The ability to remove own triggered alerts/logs from the incident. Triggered alerts and logs are displayed in the Incidents ➜ tab, where N is the ordinal number of the incident, in the Triggered alerts and Logs sections, respectively. For more details on logs and triggered alerts, see the sections Analytics Search and Triggered Alerts, respectively. |
|
Create incident schema |
The ability to create incident schemas. Incident schemas are available under Incident settings ➜ Incident schema in the Settings tab. For more details, see the section Incident Settings. |
|
Edit incident schema |
The ability to edit incident schemas. Incident schemas are available under Incident settings ➜ Incident schema in the Settings tab. For more details, see the section Incident Settings. |
|
Delete incident schema |
The ability to delete incident schemas. Incident schemas are available under Incident settings ➜ Incident schema in the Settings tab. For more details, see the section Incident Settings. |
|
Set default incident schema |
The ability to set default incident schemas. In UserGate LogAn, one default incident schema is available under Incident settings ➜ Incident schema in the Settings tab. For more details, see the section Incident Settings. |
|
Create incident state |
The ability to create incident states. The list of incident states is displayed under Incident settings ➜ Incident states in the Settings tab. For more details, see the section Incident Settings. |
|
Edit incident state |
The ability to edit incident states. The list of incident states is displayed under Incident settings ➜ Incident states in the Settings tab. For more details, see the section Incident Settings. |
|
Delete incident state |
The ability to delete incident states. The list of incident states is displayed under Incident settings ➜ Incident states in the Settings tab. For more details, see the section Incident Settings. |
|
Create incident type |
The ability to create incident types. Incident types are available in the Incident settings ➜ Incident types section of the General settings tab. For more details, see the section Incident Settings. |
|
Edit incident type |
The ability to edit incident types. Incident types are available in the Incident settings ➜ Incident types section of the General settings tab. For more details, see the section Incident Settings. |
|
Delete incident type |
The ability to delete incident types. Incident types are available in the Incident settings ➜ Incident types section of the General settings tab. For more details, see the section Incident Settings. |
|
Create incident resolution |
The ability to create incident resolutions. The list of incident resolutions is displayed in the Incident settings ➜ Incident resolutions section of the General settings tab. For more details, see the section Incident Settings. |
|
Edit incident resolution |
The ability to edit incident resolutions. The list of incident resolutions is displayed in the Incident settings ➜ Incident resolutions section of the General settings tab. For more details, see the section Incident Settings. |
|
Delete incident resolution |
The ability to delete incident resolutions. The list of incident resolutions is displayed in the Incident settings ➜ Incident resolutions section of the General settings tab. For more details, see the section Incident Settings. |
|
Create analytics rule |
The ability to create analytics rules. Analytics rules can be created in the Analytics ➜ Analytics rules tab. For more details, see the Analytics section. |
|
Delete analytics rule |
The ability to delete analytics rules. Analytics rules are displayed in the Analytics ➜ Analytics rules tab. For more details, see the Analytics section. |
|
Edit analytics rule |
The ability to edit analytics rules. Analytics rules are displayed in the Analytics ➜ Analytics rules tab. For more details, see the Analytics section. |
|
Enable/disable analytics rule |
The ability to enable or disable analytics rules. Analytics rules are displayed in the Analytics ➜ Analytics rules tab. For more details, see the Analytics section. |
|
Execute analytics rule |
The ability to execute an analytics rule not in real time. Analytics rules are displayed in the Analytics ➜ Analytics rules tab. For more details, see the Analytics section. |
|
Create response action |
The ability to create response actions. Response actions can be created in the Analytics --> Response actions tab. For more details, see the section Response Actions. |
|
Edit response action |
The ability to edit response actions. Response actions are displayed in the Analytics --> Response actions tab. For more details, see the section Response Actions. |
|
Delete response action |
The ability to delete response actions. Response actions are displayed in the Analytics --> Response actions tab. For more details, see the section Response Actions. |
|
Enable/disable response action |
The ability to enable or disable response actions. Response actions are displayed in the Analytics --> Response actions tab. For more details, see the section Response Actions. |
|
Create a UserGate sensor |
The ability to create UserGate sensors. UserGate sensors can be created under Sensors ➜ UserGate sensors in the Settings tab. For more details, see UserGate Sensors. |
|
Edit a UserGate sensor |
The ability to edit UserGate sensors. UserGate sensors are available under Sensors ➜ UserGate sensors in the Settings tab. For more details, see UserGate Sensors. |
|
Enable/disable a UserGate sensor |
The ability to enable/disable UserGate sensors. UserGate sensors are available under Sensors ➜ UserGate sensors in the Settings tab. For more details, see UserGate Sensors. |
|
Delete a UserGate sensor |
The ability to delete UserGate sensors. UserGate sensors are available under Sensors ➜ UserGate sensors in the Settings tab. For more details, see UserGate Sensors. |
|
Create SNMP sensor |
The ability to create SNMP sensors. SNMP sensors can be created under Sensors ➜ SNMP sensors in the General settings tab. For more details, see the SNMP Sensors section. |
|
Edit SNMP sensors |
The ability to edit SNMP sensors. SNMP sensors are available under Sensors ➜ SNMP sensors in the General settings tab. For more details, see the SNMP Sensors section. |
|
Enable/disable SNMP sensor |
The ability to enable/disable SNMP sensors. SNMP sensors are available under Sensors ➜ SNMP sensors in the General settings tab. For more details, see the SNMP Sensors section. |
|
Delete a SNMP sensor |
The ability to delete SNMP sensors. SNMP sensors are available under Sensors ➜ SNMP sensors in the General settings tab. For more details, see the SNMP Sensors section. |
|
Create WMI sensor |
The ability to create WMI sensors. WMI sensors can be created under Sensors ➜ WMI sensors in the General settings tab. For more details, see the section WMI Sensors. |
|
Edit WMI sensors |
The ability to edit WMI sensors. WMI sensors are available under Sensors ➜ WMI sensors in the General settings tab. For more details, see the section WMI Sensors. |
|
Enable/disable WMI sensor |
The ability to enable/disable WMI sensors. WMI sensors are available under Sensors ➜ WMI sensors in the General settings tab. For more details, see the section WMI Sensors. |
|
Delete a WMI sensor |
The ability to delete WMI sensors. WMI sensors are available under Sensors ➜ WMI sensors in the General settings tab. For more details, see the section WMI Sensors. |
|
Add SNMP MIB file |
The ability to add SNMP MIB files. MIB files can be added under Sensors ➜ SNMP MIB management in the General settings tab. For more details, see the SNMP MIB Management section. |
|
Delete SNMP MIB file |
The ability to delete SNMP MIB files. MIB files are displayed under Sensors ➜ SNMP MIB management in the General settings tab. For more details, see the SNMP MIB Management section. |
|
Create Syslog rule |
The ability to create Syslog rules. Syslog rules can be created in the Log Collector ➜ Syslog section of the General settings tab. |
|
Delete Syslog rule |
The ability to delete Syslog rules. Syslog rules are displayed in the Log Collector ➜ Syslog section of the General settings tab. |
|
Edit Syslog rule and Syslog connector |
The ability to edit Syslog rules and configure Syslog. The created Syslog rules are available in the Log Collector ➜ Syslog section of the General settings tab. |
|
Enable/disable Syslog rule |
The ability to enable or disable Syslog rules. Syslog rules are available in the Log Collector ➜ Syslog section of the General settings tab. |
|
Create email group |
The ability to create emails and email groups. Emails and email groups can be created in the Libraries ➜ Emails section of the General settings tab. For more details, see the section Phones. |
|
Edit email group |
The ability to edit emails and email groups. Emails and email groups are available in the Libraries ➜ Emails section of the General settings tab. For more details, see the section Phones. |
|
Delete email group |
The ability to delete emails and email groups. Emails and email groups are available in the Libraries ➜ Emails section of the General settings tab. For more details, see the section Phones. |
|
Create phone groups |
The ability to create phones and phone groups. Phones and phone groups can be created in the Libraries ➜ Phones section of the General settings tab. For more details, see the section Phones. |
|
Edit phone group |
The ability to edit phones and phone groups. Phones and phone groups are available in the Libraries ➜ Phones section of the General settings tab. For more details, see the section Phones. |
|
Delete phone group |
The ability to delete phones and phone groups. Phones and phone groups are available in the Libraries ➜ Phones section of the General settings tab. For more details, see the section Phones. |
|
Create notification profile |
The ability to create notification profiles. In the Libraries ➜ Notification profiles section of the General settings tab, you can create two types of profiles: SMPP and SMTP. For more details on notification profiles, see the section Notification Profiles. |
|
Edit notification profile |
The ability to edit notification profiles. The list of profiles is available in the Libraries ➜ Notification profiles section of the General settings tab. For more details on notification profiles, see the section Notification Profiles. |
|
Delete notification profile |
The ability to edit notification profiles. The list of profiles is available in the Libraries ➜ Notification profiles section of the General settings tab. For more details on notification profiles, see the section Notification Profiles. |
|
Create triggered alert category |
The ability to create triggered alert categories. Triggered alert categories can be created in the Libraries ➜ Triggered alert categories section of the General settings tab. For more details on triggered alert categories, see the section Triggered Alert Categories. |
|
Edit triggered alert category |
The ability to edit triggered alert categories. The list of triggered alert categories is available in the Libraries ➜ Triggered alert categories section of the General settings tab. For more details on triggered alert categories, see the section Triggered Alert Categories. |
|
Delete triggered alert category |
The ability to delete triggered alert categories. The list of triggered alert categories is available in the Libraries ➜ Triggered alert categories section of the General settings tab. For more details on triggered alert categories, see the section Triggered Alert Categories. |
|
Edit enrichment setting |
The ability to edit an enrichment setting. The list of external enrichment services is available in the Libraries ➜ External enrichment services section of the General settings tab. For more details on external enrichment services, see the section External Enrichment Services. |
|
Enable/disable enrichment service |
The ability to enable/disable enrichment services. The list of external enrichment services is available in the Libraries ➜ External enrichment services section of the General settings tab. For more details on external enrichment services, see the section External Enrichment Services. |
After a role has been created, it can be assigned to administrator profiles.