Managing Roles

Implement Axonius Role Based Access Control (RBAC) by creating roles. Use the Roles page to create and manage roles.

A role is a predefined set of permissions. Each user is assigned to a specific role. This means that any changes to the role permissions affect all the users to whom the role is assigned.

To manage Roles:

1. From the top right corner of any page, click . The System Settings page opens.
2. In the Categories/Subcategories pane of the System Settings page, expand User and Role Management, and select Roles.

You can export the roles and related permissions to a CSV file.

The Roles page displays the following:

• Roles - the list of defined Axonius roles.
  Axonius includes the following default system roles:
  • Admin - A user with maximum permissions for all Axonius platform and product pages and capabilities.
  • Viewer - A user with 'View' permissions for all Axonius platform and product pages, and who has no access to the System Settings (including user management).
  • Read-Only (Restrict Live Data) - A user with the Read-Only role with the addition of the Restrict Live Data permission under Platform Capabilities. Users with this permission cannot use live data on asset tables: the data source dropdown offers only Latest Snapshot and Historical Date, and the default view in user settings is set to Latest Snapshot and is disabled. This overrides the system setting, even when it is set to live data. Do not apply the permission to users who have other permissions that add or modify data.
  • Restricted - A user who can view only the Dashboards page, and who has no access to all other pages and capabilities.
  • No Access - A user with no permissions.
    In addition, all roles the admin defined appear here.

• Users - The number of users in the system with that role. This does not include Service Accounts. Click on a number to open the Asset Profile page and display a list of users with that role.

• Service Accounts - The number of Service Accounts this role can access. Click the blue number to view the Service Accounts page filtered on this role.

• Roles categories and permissions levels - A role consists of multiple categories. Each category consists of a different set of permissions.

  • The Permissions List describes the permission and behavior for each category and permission.
  • Each category is summarized to one of the following levels:
    • No Access - None of the permissions within the category are enabled.
    • Partial Access - Some of permissions within the category are enabled.
    • Full Access - All of permissions within the category are enabled.

Find All Users with a Specific Role

You can find all users with a specific role.

1. In the Role table, click on the Role drop down box. All existing roles are displayed, both the system roles and the user configured roles. This does not include service accounts.

   

2. You can select one or more roles. Each selected role is represented by a chip in the search box.

• Click Clear All to clear all of your selections. Click Reset to clear the search.

Defining Basic Query Mode Fields per Role

Use the Roles setting page to define default query fields (filters) for each asset type based on user roles. These fields appear by default in Basic Query Mode on each Assets page.

1. Hover over a role row and click Edit Basic Query Fields from the top right corner.

   

2. In the dialog that opens:

   1. Select the Module, that is, the asset type: Devices, Users, Vulnerabilities, etc.
   2. Select the Basic Mode Fields for this module. The default fields are displayed. You can add and remove fields by clicking them.
   3. Click + to add settings for more modules. There is no limit on the number of modules or the number of fields to set per role.

3. Click Save.
4. A column titled Custom Basic Query Fields is added to the Roles table. When hovering over it, it displays the asset types (modules) for which you defined default fields.
5. To edit the settings, click View All Results or click the Edit Basic Query Fields button again. You can edit the settings at any time.

When no role-specific fields are set, the Axonius system default fields apply to the Basic query mode. However, users can override both system and role-based defaults by creating their own default filters directly from the Assets page.

Adding a New Role

You add a new role using the New Role drawer. Role categories are in the left pane. Sub-categories and specific permissions are displayed in the right pane.

• To view all available permissions for both platform capabilities and asset types, click All Permissions in the left pane.

• To view permissions for specific capabilities, click Platform Capabilities or expand it and select a category.

• Click Asset Types or expand it to select permissions to specific asset types. Asset types are sorted as they appear on the Axonius Assets page.

• Use the search fields in each pane to search by category/asset or permission name. When a specific category is selected, the search on the right page returns only matches from the selected category.

  

To add a new role:

1. From the Roles page, click Add Role.

2. The New Role drawer opens. Permission categories are listed in the left pane and details are in the right pane. Some categories also appear in the right pane and can be expanded.

   Note

   The following permissions are selected by default when creating a new role:

   • API access enabled
   • Add and edit private dashboards
   • View dashboard

   You can deselect them if they are not appropriate for the role you are creating.

3. In Name, provide a name for the role.

4. (Optional) Define the default folder for saved queries per role: Click this field to select a query folder. Users with that role get this folder preselected when they save a new query. When no default folder is set for a role, the Axonius system default folder applies.

5. (Optional) To choose the page that opens after users with this role log in, select a page in Home page after login. See Setting the Home Page After Login.

6. Select the permissions you want to assign to the selected role.

   🚧

   Important

   Assigning a user with a role that provides permissions to both add and edit users and roles will allow that user to create any user type with any permission level.

   📘

   Note

   To let a role see the discovery cycle status and history without starting or stopping discovery, expand System Management and select View discovery cycle status. Make sure that Run manual discovery cycle is clear.

   • A role with View discovery cycle status and without Run manual discovery cycle can see the discovery cycle status and discovery history cards on the Axonius dashboard, and the live discovery state on the top bar button (Discover Now when no cycle is running, Stop Discovery while a cycle is running).
   • Starting and stopping a discovery cycle requires Run manual discovery cycle. Run manual discovery cycle alone also shows the status and history.
   • New custom roles start without View discovery cycle status. The predefined Admin role has it, and the predefined Viewer role does not.

7. Click Save. The new role is added to the Roles table.

Setting the Home Page After Login

Use Home page after login to choose the page that opens when users with a role log in. The field is below Default folder for new saved queries in the New Role and Manage Role drawers. It does not appear when you only view a role.

To set it, you need Roles > Add permission for a new role, or Roles > Edit permission for an existing role.

To set the home page for a role:

1. Go to Settings > User and Role Management > Roles.
2. Click a custom role. The Manage Role drawer opens.
3. Click the edit icon.
4. In Home page after login, select a page.
5. Click Save.

Home page after login has the following options:

• Default (default) - Axonius opens the default Axonius home page.
• Dashboards
• Devices
• Users
• Security Findings
• AI Workforce
• Workflows
• Dashboard: dashboard name - One option for the default dashboard, and one for each custom dashboard that is not private.

Consider the following when you set the home page:

• The selected page opens one time after each login, when Axonius opens its home page. When users click Back on that page, they go to the page before it, not to the home page.
• If a user has no permission for the selected page, the user lands on the default home page. No error message appears. The permissions that each option needs are:
  • Dashboards and Dashboard: dashboard name - Dashboards > View, and access to that dashboard.
  • Devices, Users, and Security Findings - Permission to view that asset type.
  • AI Workforce - AI Workforce access.
  • Workflows - Action Center > View.
• If you delete the selected dashboard or it becomes private, users with the role land on the default home page.
• The dashboard options include every shared dashboard, not only the dashboards in your own dashboard list.

Duplicating an Existing Role

To duplicate an existing role:

1. From the Roles page, click the role you want to duplicate; the New Role drawer opens.
2. On the right side of the drawer, click the duplicate ( ) icon.
3. Change the permission name or desired permissions.
4. Click Save.

Updating an Existing Role

1. From the Roles page, click the role you want to update; the Manage Role drawer opens.
2. On the right side of the drawer click the edit ( ) icon.
3. Change the permission name or desired permissions. To change the page that opens after login, see Setting the Home Page After Login.
4. Click Save.

Deleting an Existing Role

1. From the Roles page, click the role you want to delete; the Manage Role drawer opens.
2. On the right side of the drawer, click the Delete ( ) icon.

---