Manage Command Platform users with role-based access control (RBAC)

Platform Administrators can add a user to the Command Platform and grant them access to any product. Product Administrators can also add users, but can only grant access to products they themselves have access to.

To add a user:

1. From the left menu of the Platform Home page, click User Management > Overview.
2. Click Create New User. The Create User panel appears.
3. Enter user details:
   • Email: This must be a valid email address associated with the user. You can use a distribution list as the user email address if you want, but if you do, make sure to assign read-only access to the associated user account and verify that the account does not have Administrator privileges
   • First name, last name, and time zone: These fields are editable after the account is created from the user’s Profile Settings.
4. Click Create User. The User is created and you are redirected to the User profile/user details page.
5. Here you can assign Group access and Individual access (including data access) for the user.

Platform administrators can also create custom roles which can provide users with a combination of feature permissions for InsightAppSec, InsightIDR, InsightOps, and Surface Command.

To create a custom role:

1. From the left menu of the Platform Home page, click User Management > Overview.
2. Click Create New Role.
3. Provide a name and description of the custom role.
4. In Permissions, select the products that you want to grant permissions for in this custom role.
5. In the Feature Permissions table, select the features that you want to grant permissions for in this custom role and the permission level required.
6. Click Create New Role.

You may need to edit an existing user’s privileges, product access, data access, or account details, or you may need to delete their account altogether. You can do all of this from the individual user’s pages in Users.

Edit group access

1. From the left menu of the Platform Home page, click the User Management dropdown and click Users.
2. Find the user you want to make changes to and click the User Name.
3. In Group Assignments, click Manage Group Assignments.
4. Select or deselect the checkbox for each of the groups you want to add or remove a user from. There is an overview of the products, roles, and users, as well as additional group details in each group detail.
5. Click Save Group Access to apply your changes.

Edit individual access

1. From the left menu of the Platform Home page, click the User Management dropdown and click Users.
2. Find the user you want to make changes to and click the User Name.
3. In Individual Access, click Manage Individual Access.
4. Select or deselect the checkbox for each of the products you want to add or remove access for.
5. In roles, add or remove roles as required.
6. If applicable, in the Manage data access dropdown, assign the specific data access required.
7. Click Save Individual Privileges to apply your changes.

Edit user name and time zone

1. From the left menu of the Platform Home page, click the User Management dropdown and click Users.
2. Find the user you want to make changes to and click the User Name.
3. Click Edit User Details.
4. Adjust the user’s First Name, Last Name, and Time Zone as needed.
5. Click Save User Details to apply your changes.

Delete a user

1. From the left menu of the Platform Home page, click the User Management dropdown and click Users.
2. Find the user you want to delete and click to open the user overview.
3. Click Delete User.

You can access individual user profiles to view all of the products, roles, groups, and resources a user is assigned. The user profile also highlights whether access was assigned directly or if it was inherited through a user group. This is helpful if you’re trying to troubleshoot issues with a specific user's level of access.

You can review SSO (Single Sign On), MFA (Multi-Factor Authentication), and Password Policy from Overview. The health report provides an overview of the authentication settings in your account, including whether these authentication options are active for your organization, what these authentication options do, and directing you to the settings pages for each of these authentication steps. Based on the status of these settings, we may recommend changes to improve security.

If a user is having issues accessing their Command Platform account, see the following common troubleshooting scenarios and the steps you can take to resolve the issue.

Account locked

If a user is having trouble signing in to the Command Platform, you can use the Reset Password button to send an email to the user, allowing them to reset their password, security question, and security question answer.

Account not activated

If a user's account status shows that it is pending activation, you can use the Resend Activation Email button to send an email to the user, providing them with a new activation link.

Multi-factor authentication issue

If the user has issues with their multi-factor authentication (MFA) configuration or needs to register a new device for MFA, click the Reset MFA button and the user will receive an email letting them know how to reconfigure their MFA settings.

1. From the left menu of the Platform Home page, click the User Management dropdown and click Overview.
2. Click Create New Group.
3. Enter a Group Name and a Group Description to make it easy for you and others to find and identify this user group in the future.
4. Click Create Group.
5. Your group has been created and you can now assign product access and roles in Group Privileges. Select the required products and roles and click Save Group Access once you’re done.
6. You can select users to add to this newly created group in Group Members. Select the users you want to add to this group and click Save Group Members when you’ve finished your selection.

1. From the left menu of the Platform Home page, click the User Management dropdown and click Groups.
2. Find the user group you want to edit and click to open the Group overview.
3. You can edit the group name and description.
4. Click Manage Group Privileges and select or deselect the checkbox to modify permissions. You can also edit the user role and data access as required. Click Save Group Access once you’re done.
5. Click Manage Group Members and select users to add to the group. Click Save Group Members when you’re done.

1. From the left menu of the Platform Home page, click the User Management dropdown and click Groups.
2. Find the group you want to delete and click the ellipsis (...) and click Delete Group.
3. Confirm that deleting this group won't lead to any users losing required access.
4. Click Delete Group.

Note: users assigned InsightConnect receive full access to the product regardless of the selected role. To restrict access to InsightConnect, deselect the InsightConnect product for that user.

Feature reference

For more information on what each feature governs as well as the levels of access available to the feature, review the following table:

Built-in roles reference

For more information on what each InsightIDR built-in role can access within the product, review the following drop-down sections:

Product roles assigned to InsightVM users at the Platform level are ignored in favor of the more detailed and specialized InsightVM user roles, which are assigned to users by a Global Administrator in InsightVM. That means Platform users who are also InsightVM users are given InsightVM privileges associated with whatever role they’re assigned in InsightVM. Platform users who are not also InsightVM users are treated as Global Administrators.

Due to the nature of using Automation, InsightConnect provides full access to all users who are assigned the InsightConnect product. The View and View and Change roles at the user level do not apply. To restrict access to InsightConnect, deselect the InsightConnect product for the given user.

By default, InsightIDR and InsightOps users will be assigned access to all current and future logs and log sets. The ability to manage log access at a user or user group level will not be available within from this page unless this default behavior is turned off.

You can turn off this default setting from the User Management Overview page so that all log access must be assigned to specific users or user groups by an Administrator in your account.

As with other resources, use the check box next to each log to specify which user can access that particular log. Additionally, and unlike other resources, you have the option to restrict data access to individual logs by clicking the restricted icon in the log table.

If a user doesn’t belong to a user group, restricting log access amounts to the same thing as simply leaving the log unselected. However, if a user does belong to a user group, restricting log access allows you to override any log access the user inherited from the group.

To illustrate how restricting log access works in practice, here are a few common scenarios:

• A user is individually given access to Log A, and Log B is left unchecked.
  • Result: The user only has access to Log A.
• A user is individually given access to Log A, and Log B is left unchecked. However, the user is also a part of a user group that has access to Log B.
  • Result: The user has access to Log A and Log B.
• A user is individually given access to Log A, and Log B is marked as restricted. But the user is also a part of a user group that has access to Log B.
  • Result: The user only has access to Log A.

Log and log set selection

When you select which logs a user should have access to, you can select entire groups of logs, called log sets, by clicking the check box next to the name of the log set. Alternatively, you can select every log within the log set. Regardless of your assignment method, giving a user access to an entire log set automatically grants them access to any logs added to that log set in the future.

Similarly, if you restrict access to a log set, every log within the set is automatically restricted, as are any logs that are added to the set in the future.

You can also select, deselect, and restrict access to individual logs within a set.

If you select only some, and not all, of the logs within a particular log set, the user is only given access to the selected logs, even if additional logs are added to the set in the future.

Similarly, if you select a log set, but restrict access to at least one log within the set, the user is only given access to the selected logs, even if additional logs are added to the set in the future.

You can review any conflicts in User Management > Conflicts to get more details about the type of conflict and a conflict description. There are 3 categories of conflicts: group conflicts, user conflicts, and conflicts associated with limited access. For group conflicts and user conflicts, the Command Platform defaults to the principle of least privilege, meaning the user is given the lowest privilege assigned to them until the source of the conflict is resolved.

A user conflict can be caused by:

• Directly assigning a user 1 role that has conflicting privileges with a role they inherited from a user group.
• Inheriting roles with conflicting privileges from one or more user groups
• Via the Insight Account API directly assigning a user 2 roles that grant them access to the same feature but with different levels of privilege.

This is only possible via the InsightAccount API. A conflict can occur within a single user group when 2 or more roles within the group contain conflicting privileges. As always, the access level of all users within the group will be based on the principle of least privilege, meaning users will be granted the lowest privilege assigned to them.

Note: Groups created before previously may have this conflict.

You’re notified of a limited access conflict when a user does not have the minimum required access for a product they are assigned. Minimum required access is what Rapid7 defines as the least access required for a user to be able to get value from the product they have access to. If these conflicts are not resolved, they impact a user’s ability to get valuable information from the product.

Privilege conflict resolution methods vary by conflict type.

To identify the type of conflict:

1. From the left menu of the Platform Home page, click the User Management>Conflicts.
2. You can then view conflicts by type by selecting either the Group Conflicts, User Conflicts, or Insufficient Access tabs.

To resolve group conflicts:

• Click on the Group Name in the Group Conflicts tab. Review Features with conflicts to identify what changes are required to resolve the conflict.
• Click Edit Group Privileges to edit the group access or group members.

To resolve user conflicts:

• Click on the User Name in the User Conflicts tab. Review Features with conflicts to identify what changes are required to resolve the conflict.
• Edit the groups that the user is assigned to.
• Edit the individual product access and roles the user has.

To resolve insufficient access conflicts:

• Find the User Name in the Insufficient Access tab. Review Features with conflicts to identify what changes are required to resolve the conflict.
• Click Edit Individual Privileges and edit the users’ product roles as required.