User roles and permissions

A role is a set of permissions. It decides what a user can do in your organization: for example view targets, start scans, or invite new members. You can use the two built-in roles, or create your own roles with exactly the permissions you need.

Roles work together with labels. A role decides what a user can do, and a label decides which targets the user can see. See Restrict user access with labels.

Open the roles

In the left-hand menu, under Organization Management, click Roles.

The list shows every role and whether it is All Inclusive. Use the search box to find a role, or click the Name column header to sort. Each role has buttons at the end of its row:

• Clone (blue): create a copy of the role as a starting point for a new role.

• Edit (orange): change the name and permissions of a role.

• Delete (red): delete the role.

The built-in roles

Every organization has two roles:

All inclusive roles and excluded permissions

When you create or edit a role, you build it in one of two ways:

• Choose what the role can do. Leave All Inclusive unticked. The list is called Granted Permissions, and the role can only do what you tick.

• Choose what the role can not do. Tick All Inclusive (Contains all possible permissions). The list changes to Excluded Permissions, and the role can do everything except what you tick. New permissions that are added to the product later are included automatically.

Use the first method for a restricted role, such as someone who only starts scans. Use the second method for a role that is almost an admin.

Always enable these two permissions

Whichever way you build a role, make sure it includes these permissions. Without them, users run into an empty or unavailable environment.

Add them to every role you create, also to roles that only need a small set of permissions. If you build a role with All Inclusive ticked, make sure you do not tick these two in the Excluded Permissions list.

Create a role

1. Go to Organization Management > Roles and click New Role.

2. Enter a Role Name. This field is required.

3. Choose how to build the role: leave All Inclusive unticked to grant permissions, or tick it to exclude permissions.

4. Tick the permissions. Always include View Organizations and View Dashboard. Every permission has a short description underneath. Tick the box next to a section name to tick all permissions in that section, and click the minus button next to a section to collapse it.

5. Scroll down and click Save.

The new role appears in the list. A role you build by granting permissions shows No in the All Inclusive column.

Example: a role that can only start and cancel scans

Name: Scan operator

• Organization Management: View Organizations (always include this)

• Reporting > Dashboards: View Dashboard (always include this)

• Targets: View Targets

• Vulnerability Management: View Vulnerabilities

• Scans & Runners: View Scans, Start Scans, Cancel Scans

A user with this role can see targets and findings, and start and cancel scans, but can not change targets, members or settings.

Give a role to a user or a group

You can assign roles in two places:

• Directly to a member: go to Members, and in the Roles column of the user, click the role field and tick one or more roles.

• Through a group: go to Groups, and in the Roles column of the group, pick a role. Members of the group get this role. See Manage user groups.

Your own roles also show up in these lists as soon as you create them.

Permission reference

Permissions are grouped in sections. Most sections have View permissions to see things, and other permissions to change them.

Organization Management

Targets and scans

Vulnerability Management

Reporting and audit

Integrations

Payment and subscription

Tips

• Always enable View Organizations and View Dashboard in every role.

• Start from a clone of member or admin when the new role is close to one of them. It saves ticking every permission.

• Give people only what they need. Prefer a restricted role over admin.

• Combine roles and labels: a partner can have the Scan operator role and a label that limits them to their own targets.