Roles

Getting Here

Settings > User Management > Roles Page

---

User Management - Roles Page

The Roles Page under User Management allows administrators to manage user roles, their associated permissions, and enable role-specific capabilities. This page provides a clear breakdown of roles, functions, and access levels.

---

Page Overview

Top Action Button

• ADD ROLE

  • Description: Allows administrators to create a new role with customized permissions and capabilities.

---

Roles Table

The table displays all existing roles, including their capabilities and permissions. The following columns are available:

Field	Description
Name / Desc	The name of the role with an optional description outlining its purpose.
Masquerading	Indicates if the role has masquerading enabled (i.e., impersonation of users).
Send NetoFlow	Shows whether the role can send NetoFlow data.
Send NetoDNS	Shows whether the role can send NetoDNS data.
View Audit Logs	Indicates if the role has permission to view audit logs.
Permissions	A breakdown of the permissions assigned to the role, including:
	- Account: General account access.
	- Data Management: Access to manage data.
	- Detect & Respond: Permission to detect and respond to security events.
	- Portal: Access to portal functionalities.

---

Example Table Output

Name / Desc	Masquerading	Send NetoFlow	View Audit Logs	Permissions
label_maker	-	-	-	Account, DATA MANAGEMENT
admin	ENABLED	ENABLED	ENABLED	Account, DATA MANAGEMENT, DETECT & RESPOND, PORTAL
cloud_automation	-	-	-	Account, DATA MANAGEMENT
neto_flow	ENABLED	ENABLED	ENABLED	Account, DATA MANAGEMENT, DETECT & RESPOND, PORTAL
report_user	ENABLED	ENABLED	ENABLED	Account, DATA MANAGEMENT, PORTAL
readonly	ENABLED	ENABLED	ENABLED	Account, DATA MANAGEMENT, DETECT & RESPOND, PORTAL
operational_manager	ENABLED	ENABLED	ENABLED	Account, DATA MANAGEMENT, DETECT & RESPOND, PORTAL

---

Key Functionalities

1. ADD ROLE

   • Create new roles with specific permissions and enable or disable capabilities such as:

     • Masquerading

     • Send NetoFlow

     • View Audit Logs

2. Permissions

   • Assign specific access and control levels to roles, including:

     • Account

     • Data Management

     • Detect & Respond

     • Portal

3. Role Management

   • View, update, and manage permissions for all roles.

---

Notes

• Roles like admin and readonly are commonly used system roles with predefined permissions.

• Use the Masquerading capability carefully as it allows impersonating other users.

• Permissions such as DATA MANAGEMENT and DETECT & RESPOND control access to sensitive and critical features.

---

System Roles

Netography offers four default roles, which any user or API key can be assigned. These roles are:

• System Administrator admin This role has full management privileges for all aspects of the portal and API. For resellers, this role can masquerade as a System Administrator in a sub account.

• Operational Manager operational_manager This role has management privileges for all aspects of the portal and API, except Account and Security based settings. Meaning they are an admin for everything except creating roles, users, SSO config and API Keys. For resellers, this role can masquerade as an Operational Manager in a sub account.

• Report User report_user This role has management access to dashboards, but can not edit any other aspects of the portal nor API (threat models, devices, integrations, users, API Keys, etc.). For resellers, this role can masquerade as a Report User in a sub account.

• Read-only User readonly This role only has view/get privileges for all aspects of the portal and API. For resellers, this role can masquerade as a Read-only user in a sub account.

• NetoFlow User neto_flow Role specifically for the NetoFlow Connector. It has no other portal nor API permissions, other than to send the flow to Netography.

❗️You must have at least one user with the System Administrator role at all times.

Custom Roles

In addition to the predefined system roles, custom roles can be created which give admins the ability to override default access settings, providing granular control over which capabilities a user or API key can manage in the portal and API.

Access controls can either be set per class of objects in the portal and can either be readonly, or a combination of management criteria: create, update and/or delete(checkboxes for these options appear when you toggle a permission from read-only to manage).

🚧When using SSO, be sure to add these custom roles to the SAML Attribute role mappers.

For accounts with sub-account management enabled, custom roles can also enable or disable masquerading into the sub-accounts. However, any user that is assigned a custom role, and masquerades to a sub-account, will assume the admin role for the sub-account.