Roles: Overview

Summary: High-level overview of the different roles in RiskSense, including foundational, supplemental, and custom roles.

Role-based access control (RBAC) uses privileges (an action or set of actions available in the platform, represented by the cards on the Roles page) and associates one or more of these privileges to a role. You then assign users one or more roles based on their job and scope of work.

A role is a configuration of Allowed, Not Allowed, and Not Configured for each system privilege. Each privilege must be set to one of these three values for each role.

There are two types of RiskSense-provided roles: foundational and supplemental.

Foundational Roles

Foundational roles are a set of uneditable, predefined roles designed to provide a persona set that can use the platform differently. Use these foundational roles to give users the full RiskSense platform experience in their own intended ways.

  • Administrator: This user has all possible privileges that exist for a user. This role is for RiskSense account administrators. We recommend only giving this role to a minimal number of users.

  • Basic User: This user can use the platform's core functionality for platform access to findings and assets.

  • C Level Observer: This user can view, save, and share dashboards and filters. Other actions are denied.

  • Data Manager: This user can manage integrations, uploads, and groups in addition to other important platform data.

  • Disabled: Disables user's account access to RiskSense.

  • Read Only: This user can only view platform data. Other actions are denied.

  • Security Analyst: This user can approve false positive and severity update workflows. They can also manually upload data to the platform.

  • Vulnerability Manager: This user can manage findings, assignments, and remediation projects for your teams.

Supplemental Roles

Supplemental roles are a set of predefined roles designed to provide a specific job function to our customers that can be used in conjunction with other roles to bestow more user privileges without promoting the user to a higher foundational role and giving them additional privileges they should not have.

  • Asset Owner: Can manage assets and change an asset's group/network.

  • Automation Owner: Can use the automation module to view, create, and enable/disable playbooks.

  • Automation SLA Owner: Can use the automation SLA module to create, edit, and enable/disable SLAs.

  • Client Settings Owner: Can access and modify client-level settings.

  • Findings Assignment Owner: Can assign/unassign findings to/from other users.

  • Global Workflow Owner: Can perform all actions on all workflow types and modify other user's workflows.

  • Group Owner: Can manage user groups and user group membership.

  • Integration Owner: Can manage networks, scanners, integrations, and uploads.

  • Manual Upload Owner: Can manage networks, scanners, uploads, and assessments.

  • Risk Owner: Can perform all actions on risk acceptance and severity update workflows and modify these workflow types for other users.

  • SLA Owner: Can create, modify, and delete SLAs.

  • Tag Owner: Can fully use the Tags feature and overwrite tag ownership.

  • User & Role Provisioning Owner: Can use the Identity and Access Management (IAM) module's Users & Roles pages to create, assign, and remove users and roles.