Creating Roles - Sentinel Administration Guide (2024)

Manage Correlation Engine/Rules: Allows users to manage Correlation rules and all data associated with these rules. The Correlation feature is displayed in the Sentinel Main interface only if this permission is selected.

Manage and View Security Intelligence Dashboards: Allows user to view, create, and manage the Security Intelligence dashboards and the data displayed in the dashboards. The Security Intelligence option is displayed in the Sentinel Main interface only if this permission is selected.

View Security Intelligence Dashboards: Allows user to view the Security Intelligence dashboards and the data displayed in the dashboards. The Security Intelligence option is displayed in the Sentinel Main interface only if this permission is selected.

Only events matching the filter: Allows users to view only the events returned by the specified search query. For example, if you set the filter value to sev:5, users with this permission can view only events of severity five in a search.

For more information about using filters, see Configuring Filters in the Sentinel User Guide.

Select one or more of the following permissions to use when viewing the filtered data:

Search Data Targets: When this permission is set on a role, all members of that role can perform searches on Sentinel systems that are in a distributed location.

For more information on distributed searching and reporting, see Section 21.0, Configuring Data Federation.

View asset data: Allows users to view asset data.

View asset vulnerability data: Allows users to view vulnerability data.

View data in the embedded database: Allows users to view the data in the embedded database.

View people browser: Allows users to view the data in the Identity Browser.

View system events: Allows users to view the Sentinel system events.

Manage reports: Allows users to create, modify, run, and delete reports.

Import reports: Allows users to import reports.

Run reports: Allows users to only run reports.

Manage all alerts: Allows users to view and edit all the alerts and configure alert creation.

Manage only alerts that match the following criteria: Allows users to view and edit the alerts that match the specified criteria. This permission also allows users to configure alert creation.

Share Alert Views: Allows users to share their alert views as follows:

Edit Alert Views: Assigns the Share Alert Views permission and allows users to edit shared alert views as follows:

Share event views:Allows users to share their event views as follows:

Edit Event Views: Assigns the Share Event Views permission and allows users to edit shared event views as follows:

Discover: Discover option enables users to search and explore their data in the Sentinel.

Select one of the followings permissions that enable users to manage Discover:

Dashboard: A Dashboard is a collection of panels that helps user to analyze their data by adding a variety of panels such as visualizations, maps, markdown, and more.

Select one of the followings permissions that enable users to manage Dashboard:

Management: Management is the option to manage all things including index patterns, advanced settings and more.

Select one of the followings permissions that enable users to manage Management:

DevTools: DevTools contains tools that helps user to interact with their data by executing the commands.

Select one of the followings permissions that enable users to manage DevTools:

View incidents assigned to user: Allows a user to view any incident that is assigned to them.

View or create incidents an add events to incidents: Allows users to create incidents and add events to the incidents.

Create, modify and execute actions on assigned incidents: Allows users to create, modify, and execute actions on incidents that are assigned to them.

Manage all aspects of incidents: create, modify and delete: Allows users to manage all incidents.

Non-administrator users of the default tenant can edit shared dashboards.

Users of a non-default tenant can edit shared dashboards except public dashboards.

Non-administrator users of the default tenant can share their dashboards with other users.

Users of a non-default tenant can share their dashboards with other users of the same tenant.

Edit knowledge base: Allows users to view and edit the knowledge base in the Alert Details page.

Manage Tags: When this permission is set on a role, all members of this role can create, delete, and modify tags, and associate tags to different event sources. For more information about tags, see Configuring Tags in the Sentinel User Guide.

Manage roles and users: Allows non-administrator users to administer specific roles and users. For example, in a multitenancy environment, the MSSP administrator can delegate the responsibility of administering a tenant's roles and users to the tenant, thus reducing the load on the MSSP administrator.

Proxy for Authorized Data Requestors: When this permission is set on a role, the members of this role can accept searches from remote data sources. For more information, see Section 21.0, Configuring Data Federation.

Send events and attachments: Allows users to send events and attachments from Change Guardian and Secure Configuration Manager to Sentinel.

Share search filters: When this permission is set on a role, all members of this role can share search filters that they have created. For more information about sharing filters, see Configuring Filters in the Sentinel User Guide.

Solution Designer access: When this permission is set on a role, all members of this role can access Solution Designer. For more information, see Solution Designer.

View and execute event actions: When this permission is set on a role, all members of this role can view events and execute actions on the selected events. For more information, see Manually Performing Actions on Events in the Sentinel User Guide.

View detailed internal system state data: When this permission is set on a role, all members of this role can view detailed internal system state data by using a JMX client.

View knowledge base: Allows users to view the knowledge base in the Alert Details page.