Getting Here

Settings > User Management > Roles Page

---

User Management - Roles Page

The Roles Page under User Management allows administrators to manage user roles, their associated permissions, and enable role-specific capabilities. This page provides a clear breakdown of roles, functions, and access levels.

---

Page Overview

Top Action Button

• ADD ROLE
  • Description: Allows administrators to create a new role with customized permissions and capabilities.

---

Roles Table

The table displays all existing roles, including their capabilities and permissions. The following columns are available:

---

Example Table Output

---

Key Functionalities

1. ADD ROLE

   • Create new roles with specific permissions and enable or disable capabilities such as:
     • Masquerading
     • Send NetoFlow
     • View Audit Logs

2. Permissions

   • Assign specific access and control levels to roles, including:
     • Account
     • Data Management
     • Detect & Respond
     • Portal

3. Role Management

   • View, update, and manage permissions for all roles.

---

Notes

• Roles like admin and readonly are commonly used system roles with predefined permissions.
• Use the Masquerading capability carefully as it allows impersonating other users.
• Permissions such as DATA MANAGEMENT and DETECT & RESPOND control access to sensitive and critical features.

---

System Roles

Netography offers four default roles, which any user or API key can be assigned. These roles are:

• System Administrator admin
  This role has full management privileges for all aspects of the portal and API. For resellers, this role can masquerade as a System Administrator in a sub account.
• Operational Manager operational_manager
  This role has management privileges for all aspects of the portal and API, except Account and Security based settings. Meaning they are an admin for everything except creating roles, users, SSO config and API Keys. For resellers, this role can masquerade as an Operational Manager in a sub account.
• Report User report_user
  This role has management access to dashboards, but can not edit any other aspects of the portal nor API (threat models, devices, integrations, users, API Keys, etc.). For resellers, this role can masquerade as a Report User in a sub account.
• Read-only User readonly
  This role only has view/get privileges for all aspects of the portal and API. For resellers, this role can masquerade as a Read-only user in a sub account.
• NetoFlow User neto_flow
  Role specifically for the NetoFlow Connector. It has no other portal nor API permissions, other than to send the flow to Netography.

❗️

You must have at least one user with the System Administrator role at all times.

Custom Roles

In addition to the predefined system roles, custom roles can be created which give admins the ability to override default access settings, providing granular control over which capabilities a user or API key can manage in the portal and API.

Access controls can either be set per class of objects in the portal and can either be readonly, or a combination of management criteria: create, update and/or delete(checkboxes for these options appear when you toggle a permission from read-only to manage).

🚧

When using SSO, be sure to add these custom roles to the SAML Attribute role mappers.

For accounts with sub-account management enabled, custom roles can also enable or disable masquerading into the sub-accounts.  However, any user that is assigned a custom role, and masquerades to a sub-account, will assume the admin role for the sub-account.