Set up users, groups, and roles

Set up Cortex AgentiX and Cortex Gateway users, user groups, roles, role-based access control (RBAC), and SAML SSO authentication.

Set up users, user groups, roles, and authentication in Cortex AgentiX and Cortex Gateway. Cortex uses role-based access control (RBAC) to grant each user the minimum permissions required.

Create user roles

Roles enable you to define permissions for specific components, such as issue data, playbooks, scripts, and jobs. For example, you can create a role that allows users to edit the properties of issues, but not delete issues. You can create new roles or customize out-of-the-box roles.

If you assign one or more roles to an issue, only users with those roles can view and interact with the issue. For example, you might have an issue with sensitive data that should only be accessible to Tier-1 analysts and managers.

Roles can also be used to define permissions for integration commands. On the Integration Permissions page, you can assign roles to specific integration instances (all commands for that instance) or specific integration instance commands. For example, you could assign the Generic Export Indicators Service integration instance the Account Admin role, or you could restrict certain commands in the Core Rest API to a specific role. For more information, see Integration Permissions.

For more information about out-of-the-box roles, permissions, and how to create roles, see Roles management.

Create user groups

While roles can be assigned directly to users, we recommend creating user groups. Each user group has a single role associated with it, but each user group can contain multiple users, and user groups can be nested within each other, enabling you to further refine your RBAC requirements. Users can belong to several user groups.

For more information about user groups and how to create them, see User group management.

After adding users, assign those users to user groups or assign a direct role.

Set up user authentication

You can create users in the Customer Support Portal or by using SAML Single Sign-On (SSO) in the tenant. After you create users, they authenticate by doing the following:

• Authenticate through the Customer Support Portal
• Authenticate by using SAML Single Sign-On (SSO) in the Cortex tenant

For more information about setting up authentication, see Set up authentication.

Manage users

By default, users do not have roles assigned and do not automatically have access to tenant data until you assign them a role or add them as members of a user group that has an assigned role.

For more information about how to manage users, see User management.