Role Permissions Matrix

​

The four default roles

ThreatAware ships with four read-only default roles. Their summary headers (from Settings → Roles → View) are: Default roles cannot be edited. To deviate from these grants, Create Role (button top-right of Settings → Roles) and configure each permission area.

​

Permission areas

Each role’s permissions are grouped into nine collapsible sections. Each section shows a single high-level badge (Full access / Partial write access / Partial view / View access / No access) and expands to per-item settings (View / View and manage / Manage / None / etc.). The nine sections — in the order they appear in the Roles editor — are:

1. Data Visibility — Device, User, Network Device Visibility scopes
2. Studio — Reporting / dashboards permission
3. Device Inventory — Saved views, columns, notes, X-Ray, Action Center, Tracked View Actions, Automation Templates
4. Vitals — Vitals, Workflow Automation, Vitals Issues
5. User Inventory — Saved views, columns, user actions
6. Browser Extension — Login access
7. Reports — Reports / Scheduled Reports / Previous Reports
8. User Management — Users, Roles, Teams, SSO Setup
9. Settings — Integrations, Tags, API Keys, Misc, Audit Log, Audit Log Notes, IP Locations, Pin Data

​

Section badge matrix

How each default role scores across the nine sections:

​

Selected per-item details

Where the section badge masks meaningful differences, here are the per-item values seen live. None means the role can’t perform that action at all.

​

Device Inventory

In ThreatAware 3.3 the Tracked View Actions permissions control Tracked Views: you need manage on the scope that matches the view (Global, Team or Private) to track it, edit it or stop tracking. On ThreatAware 3.2 they’re called Saved View Actions and control Actions created from saved views. * The live UI label currently reads “Automation Tempalates outside my scope” (typo).

​

Vitals

Creating, editing and publishing Custom Vitals needs Manage on Vitals (ThreatAware 3.3 and later).

​

User Inventory

​

Reports

​

User Management

​

Settings

​

Studio and Browser Extension

Single-item sections:

​

Data Visibility

All four defaults have All for Device / User / Network Device Visibility. To restrict visibility, build a custom role and set its visibility to All except selected tags or Selected tags. See Limit what a role can see.

​

Custom roles

Click Create Role at the top-right of Settings → Roles to clone-and-edit a default into a custom role. You can also restrict Device / User / Network Device Visibility to a saved view, giving you data-level filtering on top of capability filtering.

​

See also