Roles management

Manage Cortex AgentiX roles, permissions, and role assignments in Cortex Gateway and tenant environments.

You can assign the following permissions to various components in Cortex:

Permission	Description
None	No access to the specified component.
View	View, but cannot edit the specified component.
View/Edit	View and edit the specified component.

Out-of-the-box roles in Cortex AgentiX

Cortex AgentiX includes several out-of-the-box roles, such as:

Role	Type	Description
Account Admin	Predefined	A super user role that is assigned directly to the user in Cortex Gateway or tenant and has full access to all Cortex products in your account, including all tenants added in the future. In Cortex Gateway, the Account Admin can assign roles for Cortex instances, and can also activate Cortex tenants specific to the product. This user has the same view/edit permissions in the tenant as the Instance Administrator. Note The user who activated Cortex AgentiX is assigned the Account Admin role. You can add the role to a user in Cortex Gateway or the tenant. You can only remove the Account Admin role from a user in Cortex Gateway. Only users with the Account Admin role can add or remove another Account Admin user role. You cannot edit this role. You can copy the role by saving it as a new role and then changing permissions.
Instance Administrator	Predefined	View/edit permissions for all components and access to all pages in the Cortex tenant. The Instance Administrator can also assign the Instance Administrator role to other users on the tenant. If the application has predefined or custom roles, the Instance Administrator can assign those roles to other users. You cannot edit this role. You can copy the role by saving it as a new role and then changing permissions.
Viewer	Predefined	Read permissions for all components and pages in the Cortex tenant. Cortex AgentiX products comes out-of-the-box with the following Viewer roles: Viewer role created in Cortex Gateway. This role applies to all tenants. In the Cortex AgentiX tenant, you cannot edit this role, apart from changing advanced settings such as default dashboards. In Cortex Gateway, you can change permissions, apart from advanced settings. You can also delete the role (if not assigned to a user). Viewer role created in the tenant. This role is specific to the tenant. You can edit all permissions and delete the role (if not assigned to a user) in the tenant.

By default, users do not have roles assigned. If no direct or user group role has been assigned, users don't have permission to view or edit data in the Cortex tenant.

Next steps

Before you start creating or customizing roles, do the following:

• Review the Role-based permissions topic.
• Decide where you want to create roles (Cortex Gateway, the tenant, or both).

  Any roles and user groups created in Cortex Gateway are available for all tenants. In the Cortex tenant, all roles created in the tenant are specific to the tenant. Advanced settings such as default dashboards/queries and shifts can only be defined at the tenant level. Only user groups created on the tenant can be mapped to SAML groups when using SAML SSO.
• Decide whether you want to assign roles to users directly or through membership in user groups (recommended) in Cortex Gateway or the Cortex tenant.