Links

Role-Based Access Control

Role-Based Access Control (RBAC) lets you configure fine-grained user access in Panther.
A role is a configurable set of permissions, and each user is assigned to one role. You can use the default roles provided, customize them to your needs, and/or create new roles. For certain permissions, you can restrict accessible log types. It is possible to create a role with no permissions.
You can manage your instance's roles in your Panther Console or with the Panther API.

Panther user roles

Default roles

When you first deploy Panther, the following three roles are automatically created for you:
  • Admin
    • This role is automatically assigned to all existing users and has all available permissions.
  • Analyst
    • This role can use all the cloud security and log analysis features, but cannot modify settings.
  • AnalystReadOnly
    • This role can view resources and alerts and Python code, but cannot change anything.
The default roles screen in the Panther Console shows three roles: Admin, Analyst, and AnalystReadOnly.

Customizing roles

A user assigned to a role that has the Manage Users permission (or UserModify, if created through the API) can customize all other roles.
  • There is no limit on the number of roles you can create.
  • You can rename roles, but all roles must have unique names.
  • You can change permissions on roles, but at least one user must have the Manage Users/UserModify permission.
  • You can delete a role if no users are currently assigned to it.
The role editor screen in the Panther Console displays a field to add a name, and options to customize permissions.
For instructions on customizing a role with restrictions on certain log types, see the section below titled RBAC per Log Type for Data Explorer and alerts.
  • Permission changes will not take effect until the affected user refreshes the browser where they are logged in to Panther or signs out and back in to Panther.
  • If, after updating a user's permissions, the user continues to see an access denied error, double-check to see if they are missing another Read permission that would be required for the page they are trying to access

Creating a new role

Follow the instructions below to create a new role in the Console. To create a new role using the Panther API, follow these instructions.
  1. 1.
    In the Panther Console, click the gear icon in the upper right to open the Settings menu, then User Roles.
  2. 2.
    In the upper right, click Create New.
  3. 3.
    In the Name field, enter a descriptive name for the role.
  4. 4.
    Select the checkbox for each of the permissions you'd like this role to have.
    1. 1.
      Currently, some permissions support log type filtering. (See RBAC per log type for Data Explorer and alerts for more information.) If you select a permission that supports log type restrictions, choose one of the following options:
      • Full access to logs
      • Allow access to selected Log Types
      • Deny access to selected Log Types
        In an Alerts section, a checkbox next to View Alerts is checked. Below, there are three radio buttons: Full access to logs, Allow access to selected Log Types, and Deny access to selected Log Types. The second one has been selected, and a Select Log Types dropdown has one value: AWS.ALB
    2. 2.
      If you opted to Allow access to selected Log Types or Deny access to selected Log Types, in the Select Log Types dropdown, select the individual log types the user should be allowed to access or restricted from accessing.
      • Be sure to read through the limitations listed below to understand the current limitations of the RBAC by log type feature.
      • Remember that log type selections sync across all permissions that support log type restrictions, for a given role.
  5. 5.
    Click Create Role.
    • Note that it may take a up to one minute for your change to propagate across all of Panther's services.
You can now assign the role to users you onboard onto Panther.

RBAC per log type (beta)

This closed beta feature is part of a larger capability to enable RBAC per log type, with an initial focus on enforcing controls in alerts and search tools.

Prerequisites for customer-configured Snowflake accounts

If you're using a customer-configured Snowflake instance (formerly known as Bring Your Own Snowflake), in order to enable RBAC per log type, the following must be true:

How to restrict log types for a certain role

You can create a new role and restrict log access for it, or alter the permissions of an existing role to restrict log access. See the Creating a new role instructions, paying attention to Step 4.
RBAC per log type for search is in closed beta as of Panther version 1.41. To request access or share any bug reports or feature requests, please contact your Panther support team.
You can use the Run Log Queries permission to limit a role's log type access in Panther's search tools, including Data Explorer and Search.
In Data Explorer, only tables for the log types the user has access to will display in the Data Explorer filter list, as well as in predictive text in the SQL editor.
When pivoting into Data Explorer from another area of the Console (such as from a log source's Schemas view), if the filled SQL query references a table for a log source the user does not have access to, upon running the query, the user will receive an error.
In Search, database tables for restricted log types will not populate in the tables filter.

RBAC per log type for alerts

RBAC per log type for alerts is in closed beta as of Panther version 1.63. To request access or share any bug reports or feature requests, please contact your Panther support team.
You can use the View Alerts and Manage Alerts permissions to limit a role's access to alerts based on log type. When selecting either of these permissions, you will be prompted to select the log types to allow or restrict access to.
The set of accessible log types selected for View Alerts and Manage Alerts will be synced with the Run Log Queries permission. One role cannot have two permissions with different log type restrictions.
All limitations for RBAC per log type for search, listed above, apply—except for the alerts limitation.