Role-Based Access Control
Last updated
Was this helpful?
Last updated
Was this helpful?
Role-Based Access Control (RBAC) lets you configure fine-grained user access in Panther.
A role is a configurable set of permissions, and each user is assigned to one role. You can use the default roles provided, customize them to your needs, and/or create new roles. For certain permissions, you can . It is possible to create a role with no permissions.
You can manage roles in your Panther Console or with the Panther or .
When you first deploy Panther, the following three roles are automatically created for you:
Admin
This role is automatically assigned to all existing users and has all available permissions.
Analyst
This role can use all the cloud security and log analysis features, but cannot modify settings.
AnalystReadOnly
This role can view resources and alerts and Python code, but cannot change anything.
A user assigned to a role that has the Manage Users permission (or UserModify
, if created through the API) can customize all other roles.
There is no limit on the number of roles you can create.
You can rename roles, but all roles must have unique names.
You can delete a role if no users are currently assigned to it.
To update the permissions associated to a role:
In the upper-right corner of your Panther Console, click the gear icon > User Roles.
Make desired changes to the permissions set.
Click Update Role.
In the upper-right corner of the Panther Console, click the gear icon, then User Roles.
Click Create New.
In the Name field, enter a descriptive name for the role.
Select the checkbox for each of the permissions you'd like this role to have.
Full access to logs
Allow access to selected Log Types
If you opted to Allow access to selected Log Types or Deny access to selected Log Types, in the Select Log Types dropdown, select the individual log types the user should be allowed to access or restricted from accessing.
Remember that log type selections sync across all permissions that support log type restrictions, for a given role.
Click Create Role.
Note that it may take a up to one minute for your change to propagate across all of Panther's services.
You can now assign the role to users you onboard onto Panther.
In Data Explorer, only tables for the log types the user has access to will display in the Data Explorer filter list, as well as in predictive text in the SQL editor.
When pivoting into Data Explorer from another area of the Console (such as from a log source's Schemas view), if the filled SQL query references a table for a log source the user does not have access to, upon running the query, the user will receive an error.
You can use the View Alerts and Manage Alerts permissions to limit a role's access to alerts based on log type. When selecting either of these permissions, you will be prompted to select the log types to allow or restrict access to.
The set of accessible log types selected for View Alerts and Manage Alerts will be synced with the Run Log Queries permission. One role cannot have two permissions with different log type restrictions.
You can , but at least one user must have the Manage Users/UserModify
permission.
For instructions on customizing a role with restrictions on certain log types, see the section below.
In the upper-right corner of the tile for the role you'd like to update, click the three docs icon > Edit.
Follow the instructions below to create a new role in the Console. Alternatively, you can create a new role using the Panther or .
Currently, some permissions support log type filtering. (See for more information.) If you select a permission that supports log type restrictions, choose one of the following options:
Deny access to selected Log Types
Be sure to read through the to understand the current limitations of the RBAC by log type feature.
While this feature is available to all customers with , Panther must first enable it for your instance. If you are interested in using it, please reach out to your account team.
If you're using a Snowflake instance, in order to enable RBAC per log type, the following must be true:
Your must be Enterprise or higher.
The pantheraccountadmin
user account must be enabled in your Snowflake instance. If it is not already enabled, follow the instructions in .
You can create a new role and restrict log access for it, or alter the permissions of an existing role to restrict log access. See the , paying attention to Step 4.
You can use the Run Log Queries permission to limit a role's log type access in Panther's search tools, including and .
In Search, database tables for restricted log types will not populate in the .
Alerts: This feature does not currently enforce RBAC per log type restrictions in alerts or, and therefore blocks users from viewing/managing them (unless the feature is enabled).
All , apply—except for the alerts limitation.