# User Access Management

{% hint style="info" %}
Before you start, [change the password.](https://docs.logpoint.com/siem/readme/user-configuration/..#change-user-password)
{% endhint %}

Authentication and authorization of Logpoint SIEM users is based on user roles and the permissions granted to those roles. SOAR Automation user access management works the same, but a separate license is required.

* Add permissions to Permission Groups.
* Assign one or more Permission Groups to a User Group.
* Assign Users to User Groups.

## Permission Groups

There are two default standard permission groups. You can't modify or delete them.

### Admin Permission Group

Grants comprehensive access, including read, create, and delete access rights. It is for users or administrators who require full access rights to Logpoint for comprehensive configuration and maintenance.

<figure><img src="https://2590616924-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FZJI3Yx2mS6Pn4JEd0IKM%2Fuploads%2FTJmoOLUs02GibewQKR3e%2Fimage.png?alt=media&#x26;token=281178f2-e70c-40bc-ae74-3aebf6a6bf96" alt=""><figcaption></figcaption></figure>

### Operator Permission Group

Operators can monitor and investigate by viewing dashboards and widgets, running searches, and using search templates, packages, and views to investigate events. Users in the operator permission group can create and modify their own dashboards and alerts, build and maintain searches and reports, and maintain the analytics content used by the SOC. Operators have read and create permissions for **Incidents,** allowing them to view incidents assigned to them or their group, investigate incidents, and create new incidents from alerts or investigations.

<figure><img src="https://2590616924-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FZJI3Yx2mS6Pn4JEd0IKM%2Fuploads%2F377xz2LDlbZ0DBTes2uv%2Fimage.png?alt=media&#x26;token=73c4eca5-baed-4eee-8e62-fc8b19fd9c41" alt=""><figcaption></figcaption></figure>

You can also assign the user groups Incident User Groups and Data Privacy Groups.

After a user is created, they must be authenticated based on their credentials to log in and access Logpoint. Logpoint supports multiple authentication methods, including local authentication, external Identity Providers (IdPs), and Multi-Factor Authentication (MFA).

<details>

<summary>Viewing Permission Groups</summary>

1. In the navigation bar, click **Settings>>Users**.
2. Click **Permission Groups**.

   <figure><img src="https://2590616924-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FZJI3Yx2mS6Pn4JEd0IKM%2Fuploads%2FjVzLkZcxsz1jk5pDO7Hz%2Fimage.png?alt=media&#x26;token=bfa2de29-b89c-4c69-ba07-1b388f964b55" alt=""><figcaption></figcaption></figure>
3. Sort the columns in ascending and descending order by clicking the arrow in the column name.

   <figure><img src="https://2590616924-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FZJI3Yx2mS6Pn4JEd0IKM%2Fuploads%2FkU86sVmBa9h7KcDl9KJB%2Fimage.png?alt=media&#x26;token=499733fa-df34-4191-ac91-5614de2f23bd" alt=""><figcaption></figcaption></figure>
4. To add or remove which columns are visible, click the **More** dropdown, and click **Columns**. Deselect the columns not to display.

</details>

### New Permission Groups

Permission groups streamline user management, and tailor permissions to align with organizational roles and responsibilities. According to your organization’s structure and the user’s responsibility, setup different permission groups. You can edit, delete, or create new groups.

When a new permission group is added, it is reflected in Logpoint SIEM and SOAR automation of the users.

SIEM Permissions:

* Knowledge Base
* Configuration
* Analytics

<figure><img src="https://2590616924-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FZJI3Yx2mS6Pn4JEd0IKM%2Fuploads%2F0WVC83E10G3JC22vZNJq%2Fimage.png?alt=media&#x26;token=98bf309f-3121-49a5-a2df-8af48b13114e" alt=""><figcaption></figcaption></figure>

<details>

<summary>Add a New Permission Group</summary>

1. Go to **Settings > User Accounts** from the navigation bar and click **Permission Groups**.
2. Click **Add**.
3. Enter a **Name** and a **Description**.
4. All permissions are selected by default. Under **Knowledge Base**, **Configuration**, and **Parsers**, deselect the permissions the users shouldn't have. You must deselect them one by one.

{% hint style="info" %}
SOAR Automation permissions are only accessible if you have a license.
{% endhint %}

5. Click **Submit**.

</details>

<details>

<summary>Editing Permission Group</summary>

1. Go to **Settings >> User Accounts** from the navigation bar and click **PermissionGroups**.
2. Click the name of the permission group.
3. Remove permissions or change access rights.
4. Click **Submit**.

</details>

<details>

<summary>Delete Permission Groups</summary>

Before deleting a permission group, verify it is not in use.

1. Go to **Settings > User Accounts** from the navigation bar and click **Permission Groups**.
2. To delete:
   * a single permission group: select it in the list and in the Actions column, click the Delete icon.
   * multiple permission groups: select the permission groups, click the **MORE** dropdown, and click **Delete Selected**.
   * all the permission groups: click the **MORE** dropdown and click **Delete All**.
3. Click **Yes**.

</details>

#### SOAR Playbooks Permissions

| SOAR Playbooks           | Read                                                                | Create                                                     | Delete           |
| ------------------------ | ------------------------------------------------------------------- | ---------------------------------------------------------- | ---------------- |
| Playbook Actions         | <p>- List playbook.<br>- Export or Enable or Monitor playbooks.</p> | <p>- Clone or Add or Edit playbook.<br>- Run playbook.</p> | Delete playbook. |
| Manage Playbook Triggers | List triggers.                                                      | Add or Edit triggers.                                      | Delete triggers. |

#### SOAR Settings Permissions

| SOAR Settings    | Read                                                                                              | Create                                                                        | Delete                                |
| ---------------- | ------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------- | ------------------------------------- |
| Integrations     | <p>- Export or View Vendors.<br>- Export or View Products.<br>- Search before Export or View.</p> | <p>- Add or Edit Vendors and Products.<br>- Add or Edit or Clone Actions.</p> | Delete Vendors, Products and Actions. |
| API Key          | View API Key.                                                                                     | Generate API Key.                                                             | N/A.                                  |
| Licensing        | View License                                                                                      | Upload License.                                                               | N/A.                                  |
| My Products      | Export or View Products.                                                                          | Add or Edit Products.                                                         | Delete Products.                      |
| Lists Management | View List.                                                                                        | Add or Edit List.                                                             | Delete List.                          |
| Import           | N/A.                                                                                              | Upload imported Settings.                                                     | N/A.                                  |
| System Health    | View System Health.                                                                               | N/A.                                                                          | N/A.                                  |

#### SOAR Cases Permissions

| SOAR Cases   | Read                  | Create                                                                                                                                 | Delete                    |
| ------------ | --------------------- | -------------------------------------------------------------------------------------------------------------------------------------- | ------------------------- |
| Manage Cases | Export or View Cases. | <p>- Add or Edit or Annotate Cases.<br>- Tag or Comment or Edit item to Cases.<br>- Change Case Status and Change Handling Status.</p> | Delete Label and Comment. |

***

## User Groups

Group users and grant them the same permissions. Admin users can also grant permissions to repositories and device groups to a user group.

There are three default, standard user groups. You can't modify or delete them.

* Logpoint Administrator: Users have full access to all features and settings.
* User Account Administrator: All permissions except for [System Settings](https://docs.logpoint.com/siem/readme/system-settings). This User Group cannot view the Logpoint Administrator group.
* Incident User Groups: Manage incidents, including alert ownership and access to incident details. All Logpoint users can view incidents, but they can't resolve or close them. Only users who are part of the Logpoint Administrator group and the User Account Administrator group can grant access or add users to Incident User Groups.

<figure><img src="https://2590616924-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FZJI3Yx2mS6Pn4JEd0IKM%2Fuploads%2FSg8wThj6q4mpToqpDSTR%2Fimage.png?alt=media&#x26;token=c297642a-56f6-4301-b58c-51d5466e6d79" alt=""><figcaption></figcaption></figure>

### Data Privacy User Groups

Users who are linked to a [Data Privacy](https://docs.logpoint.com/siem/readme/system-settings/data-privacy) User Group can administer access to encrypted user data. Data Privacy encrypts specific clear-text fields so they are hidden from non-admin Logpoint users. Encrypted data can only be viewed by non-admin users by request, and then a user who is part of a Data Privacy user group can grant access to the data.

<figure><img src="https://2590616924-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FZJI3Yx2mS6Pn4JEd0IKM%2Fuploads%2F3NUKG8VN4Wpx9zkpzB77%2Fimage.png?alt=media&#x26;token=b5c2d0d5-a370-4bdf-bbcd-159922fddebc" alt=""><figcaption></figcaption></figure>

<details>

<summary>Viewing User Groups</summary>

1. In the navigation bar, click **Settings >> Users**.
2. Click **User Groups**.
3. Sort the columns in ascending and descending order by clicking the arrow in the column name.

   <figure><img src="https://2590616924-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FZJI3Yx2mS6Pn4JEd0IKM%2Fuploads%2FD9mev9bD8vnuov9rBSBT%2Fimage.png?alt=media&#x26;token=bfaad371-fee2-4a93-8094-08999d642c80" alt=""><figcaption></figcaption></figure>
4. To add or remove which columns are visible, click the **More** dropdown, and click **Columns**. Deselect the columns not to display.

</details>

### New User Groups

When you create a new user group, you grant the group which permissions they have. In addition, if you are an admin user, you also grant repo and device access to a user group in addition to a universal query. User groups can access all repos and devices or specific repos and devices, depending on what they are granted access to. Device groups include all devices, log sources, and IP addresses within the group.

You use a universal query to differentiate searches between user groups. For example, if a universal query is set to `col_type=syslog`, then only logs corresponding to `col_type=syslog` are in the search results for the user group assigned to that universal query.

You must set up different user groups, other than the two default ones, according to your own organization's structure, and which users should have the same access as other users. You can edit the groups you add, delete them, or create new ones. Add User Groups, then assign an Incident User Group to manage incidents.

<details>

<summary>Adding a New User Group</summary>

1. Go to **Settings > User Accounts** from the navigation bar and click **User Groups**.
2. Click **Add**.
3. Enter a **Name** and a **Description**.
4. Enter a **Universal Query**. You use a universal query to differentiate searches between user groups. For example, if a universal query is set to `col_type=syslog`, then only logs corresponding `to col_type=syslog` are in the search results for the user group that is assigned that universal query.
5. Select a **Permission Group**.

   User Groups can be granted access to all Repos and Devices, or you can select specific Repos and Devices. Device Groups include all the devices, log sources, and IP addresses part of the group.
6. Click **Object Permissions**. To grant access to:
   1. repos, device groups, devices, log sources and IP addresses in all of the Logpoint in your environment, select **Full Permission**.
   2. Select **All Repos** for only Repo access.
   3. Select **All Devices** for only Device access.
   4. To grant access to specific Devices and Repos, click **Advanced selection**. Devices and Log Sources not assigned to any device group are listed under **Ungrouped**.
7. Click **Confirm**.
8. Click **Save**.
9. Click **Submit**.

</details>

<details>

<summary>Editing a User Group</summary>

1. Go to **Settings > User Accounts** from the navigation bar and click **User Groups**.
2. Select the user group to edit.
3. Change the name, query, permission group and/or the repos or devices the group has access to.
4. Click **Submit**.

</details>

<details>

<summary>Deleting User Groups</summary>

To delete a User Group, verify it is not in use.

1. Go to **Settings > User Accounts** from the navigation bar and click **User Groups**.
2. To delete:
   1. a single user group: select it in the list and click the **Delete** icon from **Actions**.
   2. multiple user groups: select the user groups, click the **MORE** dropdown, and select **Delete Selected**.
   3. all the user groups: click the **MORE** dropdown and select **Delete All**.
3. Click **Yes** to confirm.

</details>

### Incident User Groups

[Incident management](https://docs.logpoint.com/siem/readme/a_work-with-your-log-data/incident-management), including assigning alert ownership, is controlled by users whose user group is also linked to an Incident User Group. Only users who are part of an Incident User Group can own or manage an Alert Rule. Only users in the Logpoint Administrator and User Account Administrator user groups can grant access or add users to Incident User Groups.

<details>

<summary>Adding User Groups to an Incident User Group</summary>

1. Go to **Settings > User Accounts** from the navigation bar and click **Incident User Groups**.
2. Click **Add**.
3. Double-click or drag and drop the user groups to select.
4. Click **Submit**.

   [![Assign User Groups to an Incident User Group so they can manage incidents](https://2590616924-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FZJI3Yx2mS6Pn4JEd0IKM%2Fuploads%2Fgit-blob-2d818c030188df29cf31053461c982ba35d1b52e%2Fincident.jpg?alt=media)](https://newportal.logpoint.com/Content/Resources/Images/Incident%20User%20Groups/incident.jpg)

</details>

### Data Privacy

Data Privacy encrypts specific clear-text fields, hiding them from non-admin Logpoint users. Encrypted data can be viewed only by non-admin users upon request, and only a user in a Data Privacy user group can grant access.

Only admin users and user account administrators can set up Data Privacy User Groups. There are two group types:

* **Can Request Access** — users who can send a request to view encrypted data.
* **Can Grant Access** — users other than admin users who can grant viewing access to encrypted data.

Users in a **Can Grant Access** user group do not automatically have access to encrypted data. They also need to be part of a **Can Request Access** user group and send a request. A user cannot view decrypted data without another user's consent.

<figure><img src="https://2590616924-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FZJI3Yx2mS6Pn4JEd0IKM%2Fuploads%2Frwlg3Hve3bl5L5DJIzbo%2Fimage.png?alt=media&#x26;token=efe9a15b-8352-414c-b309-6166fbf26197" alt=""><figcaption></figcaption></figure>

<details>

<summary>Grant access to Data Privacy User Group</summary>

1. Create a [user group.](#user-groups)
2. Add the users.
3. [Map the user](#mapping-a-user-group-to-data-privacy) group to a Data Privacy user Group.

</details>

<details>

<summary>Mapping a User Group to Data Privacy</summary>

1. Go to **Settings > User Accounts** from the navigation bar and click **Data Privacy Groups**.
2. Click **Add**.
3. Enter a **Name**.
4. Select a **User Group**.
5. Select:&#x20;
   1. Can Request Access so users can ask to view encrypted data.
   2. Can Grant Access so users other than admin or user account administrator users can grant access to encrypted data.
6. Click **Submit**.

</details>

<details>

<summary>Viewing Data Privacy User Groups</summary>

1. Go to **Settings >> User Accounts** from the navigation bar and click **Data Privacy Groups**.
   1. To sort the columns in ascending or descending order, move your cursor to the column to sort. You will see a down arrow; click it and select Sort Ascending or Sort Descending.
   2. To filter the columns in the UI, click the MORE dropdown, then select Columns, and select the columns to filter.
2. Click the **Details** icon in the **Actions** column to view user groups and their permissions, then either grant or request access.

</details>

<details>

<summary>Editing a Data Privacy User Group</summary>

1. Go to **Settings > User Accounts** from the navigation bar and click **Data Privacy Groups**.
2. Click the user group to edit.
3. Make your changes and click **Submit**.

</details>

<details>

<summary>Deleting Data Privacy User Groups</summary>

1. Go to **Settings > User Accounts** from the navigation bar and click **Data Privacy Groups**.
2. To delete:
   1. A single user group: select them in the list and click the **Delete** icon in the **Actions** column.
   2. Multiple user groups, select the user groups, click the **More** drop-down, and select **Delete Selected**.
   3. All the user groups, click the **More** drop-down and select **Delete All**.
3. Click **Yes.**

</details>

***

## Users

Users refer to individual accounts that are authorized to access Logpoint and SOAR. Each user is assigned a [user group](#user-groups) and [permission group](#permission-groups) that determine their level of access, actions they can perform, and data they can view within Logpoint and SOAR. This ensures secure, role-based access control (RBAC), allowing administrators to [add](#adding-a-new-user), [edit](#editing-a-user), or [deactivate](#deactivating-users) user accounts to maintain compliance and operational security.

<details>

<summary>Adding a New User</summary>

1. Go to **Settings >> User Accounts** from the navigation bar and click **Users**.
2. Click **Add**.
3. Enter a **Username** for the user.
4. Enter a **Password** for the username.
5. Select a **User Group.** You can associate a user with multiple user groups.
6. Enter the user's **Name** and **Email.**
7. Select the user's **Time Zone.**  Users view logs according to their time zone. For example, if a user in Denmark views logs collected in England, the logs are displayed in the Danish time zone (UTC +1). The default timezone is UTC.
8. Click **Submit**.

</details>

<details>

<summary>Editing a User</summary>

1. Go to **Settings >> User Accounts** from the navigation bar and click **Users**.
2. Click the **Username** of the user.
3. Edit their user group, email, or timezone.
4. Click **Submit**.

</details>

<details>

<summary>Deactivating Users</summary>

A deactivated user is listed in the user list, but they can't access Logpoint.

1. Go to **Settings >> User Accounts** from the navigation bar and click **Users**.
2. In **PLUGIN USERS** at the top left, select authentication. If you are using Logpoint, don't select anything.
3. To deactivate:
   1. A single user: click the De-Activate User icon from Actions.
   2. Multiple users: select the users, click the MORE dropdown, and click **Deactivate Selected.**
   3. All users: click the MORE dropdown, then select **Deactivate all**.
4. Click **Yes**.
5. Enter your credentials and click **Ok**.

</details>

<details>

<summary>Activating Deactivated Users</summary>

1. Go to **Settings >> User Accounts** from the navigation bar and click **Users**.
2. In **PLUGIN USERS** at the top left, select which authentication you use. If you are using Logpoint, don't select anything.
3. To activate:
   1. A single user: click the Activate User icon from **Actions**.
   2. Multiple users: select the users, click the MORE dropdown, and click Deactivate Selected.
   3. All users: click the MORE dropdown, then click **Deactivate all.**
4. Click **Yes**.
5. Enter your credentials and click **Ok**.

</details>

<details>

<summary>Deleting Users</summary>

You must [deactivate](#Deactivating) a user before deleting them. Also check whether they own a shared dashboard, alert rule, report template, or search template. If they do, either:&#x20;

* Delete the dashboard, alert rule, report template or search template
* Transfer ownership to another user. After you delete a user, use Transfer Ownership for each entity they own.

1. Go to **Settings > User Accounts** from the navigation bar and click **Users**.
2. In **PLUGIN USERS** at the top left, select your authentication. If you are using Logpoint,  don't select anything.
3. Click **Manage De-Activated Users**.
4. To delete:
   1. A single user, select them in the list, and click the **Delete** icon in the Actions column.
   2. Multiple users, select the users, click the More drop-down, and select Delete Selected.
   3. All users, click the **More** drop-down and select **Delete All**.
5. Click **Yes.**

</details>

<details>

<summary>Changing a User Password</summary>

1. Go to **Settings > User Accounts** from the navigation bar and click **Users**.
2. Click the **Change Password** icon from **Actions**.
3. Enter the New Password and re-enter it.
4. Click **Submit**.

</details>
