Manage Rapid7 users with role-based access control (RBAC)

1. From the left menu of the Platform Home page, click the Administration link.
2. From the left menu of the Administration page, click User Management.
3. Click the User Groups tab.
4. Click the Create User Group button. The Create New Group panel appears.
5. Enter a Group Name and a Group Description to make it easy for you and others to find and identify this user group in the future.
6. In the Products tab, select what products you wish users within this group to have access to.
7. Click on the Roles tab to assign specific user roles to all users within the group.
8. Click on the Users tab to add users to the group.
9. Click on the Data Access tab to choose which resources the users within this group should have access to.
10. Click Save Group to finish creating the group.

1. From the left menu of the Platform Home page, click the Administration link.
2. From the left menu of the Administration page, click User Management.
3. Click the User Groups tab.
4. Find the user group you want to edit.
5. Click on the edit icon.
6. Edit the products, user roles, and resources assigned to the group as needed. You can also edit the group's user membership at this time.
7. Click Save Group to save your changes.

1. From the left menu of the Platform Home page, click the Administration link.
2. From the left menu of the Administration page, click User Management.
3. Click the User Groups tab.
4. Find the user group you want to delete.
5. Click on the delete icon.
6. Click Yes, remove group to confirm.

Note: users assigned InsightConnect recieve full access to the product regardless of the selected role. To restrict access to InsightConnect, deselect the InsightConnect product for that user.

Feature reference

For more information on what each feature governs as well as the levels of access available to the feature, review the following table:

Managed roles reference

For more information on what each InsightIDR managed role can access within the product, review the following drop-down sections:

Product roles assigned to InsightVM users at the Platform level are ignored in favor of the more detailed and specialized InsightVM user roles, which are assigned to users by a Global Administrator in InsightVM. That means Platform users who are also InsightVM users are given InsightVM privileges associated with whatever role they’re assigned in InsightVM. Platform users who are not also InsightVM users are treated as Global Administrators.

Due to the nature of using Automation, InsightConnect provides full access to all users who are assigned the InsightConnect product. The View and View and Change roles at the user level do not apply. To restrict access to InsightConnect, deselect the InsightConnect product for the given user.

By default, InsightIDR and InsightOps users will be assigned access to all current and future logs and log sets. The ability to manage log access at a user or user group level will not be available within from this page unless this default behavior is turned off.

You can turn off this default setting from Data Access Controls tab so that all log access must be assigned to specific users or user groups by an Administrator in your account.

As with other resources, use the check box next to each log to specify which user can access that particular log. Additionally, and unlike other resources, you have the option to restrict data access to individual logs by clicking the restricted icon in the log table.

If a user doesn’t belong to a user group, restricting log access amounts to the same thing as simply leaving the log unselected. However, if a user does belong to a user group, restricting log access allows you to override any log access the user inherited from the group.

To illustrate how restricting log access works in practice, here are a few common scenarios:

• A user is individually given access to Log A, and Log B is left unchecked.
  • Result: The user only has access to Log A.
• A user is individually given access to Log A, and Log B is left unchecked. However, the user is also a part of a user group that has access to Log B.
  • Result: The user has access to Log A and Log B.
• A user is individually given access to Log A, and Log B is marked as restricted. But the user is also a part of a user group that has access to Log B.
  • Result: The user only has access to Log A.

Log and log set selection

When you select which logs a user should have access to, you can select entire groups of logs, called log sets, by clicking the check box next to the name of the log set. Alternatively, you can select every log within the log set. Regardless of your assignment method, giving a user access to an entire log set automatically grants them access to any logs added to that log set in the future.

Similarly, if you restrict access to a log set, every log within the set is automatically restricted, as are any logs that are added to the set in the future.

You can also select, deselect, and restrict access to individual logs within a set.

If you select only some, and not all, of the logs within a particular log set, the user is only given access to the selected logs, even if additional logs are added to the set in the future.

Similarly, if you select a log set, but restrict access to at least one log within the set, the user is only given access to the selected logs, even if additional logs are added to the set in the future.

Platform Administrators can add a user to the Command Platform and grant them access to any product. Product Administrators can also add users, but can only grant access to products they themselves have access to.

To add a user:

1. From the left menu of the Platform Home page, click the Administration link.
2. From the left menu of the Administration page, click User Management.
3. Click Create User. The Add User panel appears.
4. Enter user details:
   • Email: This must be a valid email address associated with the user. You can use a distribution list as the user email address if you want, but if you do, make sure to assign read-only access to the associated user account and verify that the account does not have Administrator privileges.
   • First name, last name, and time zone: These fields are editable after the account is created from the user’s Profile Settings.
5. Click Next to assign the new user access to products.
6. If there is an existing user group that is appropriate for the user to be added to, you can add them to it from the Manage User Groups tab.
7. If you don’t want to manage access at the user group level, click the Manage Individual Permissions tab to directly assign products, roles, and resources to the user.
8. After you have assigned products, roles, and resources, click Save to create the new user.

You may need to edit an existing user’s privileges, product access, or account details, or you may need to delete their account altogether. You can do all of this from the User Management area of the Command Platform.

Edit user access

1. From the left menu of the Platform Home page, click the Administration link.
2. From the left menu of the Administration page, click User Management.
3. Find the user you want to make changes to.
4. Click the edit icon on the right. A panel appears similar to the one you used when creating the user.
5. To add or remove a user from user groups, click the Add to Group tab. From there, you can choose which groups the user should be a part of.
6. To edit the user’s product access, user roles, and resource access directly, click on Edit Individual Permissions and make changes as needed.
7. Click Save to apply your changes.

Edit user name and time zone

1. From the left menu of the Platform Home page, click the Administration link.
2. From the left menu of the Administration page, click User Management.
3. Find the user you want to make changes to.
4. Click the edit icon on the right. A panel appears similar to the one you used when creating the user.
5. Click Edit in the User Details bar.
6. Adjust the user’s First Name, Last Name, and Time Zone as needed.
7. Click Save to apply your changes.

Delete a user

1. From the left menu of the Platform Home page, click the Administration link.
2. From the left menu of the Administration page, click User Management.
3. Find the user you want to delete.
4. Click the delete icon.
5. Click Yes, remove user to confirm.

You can access individual user profiles to view all of the products, roles, groups, and resources a user is assigned. The user profile also highlights whether access was assigned directly or if it was inherited through a user group. This is helpful if you’re trying to troubleshoot issues with a specific user's level of access.

If a user is having issues accessing their Rapid7 account, see the following common troubleshooting scenarios and the steps you can take to resolve the issue.

Account locked

If a user is having trouble signing in to the Rapid7 Command Platform, check the status of their account. If they are locked out, you can use the Reset Account button to send an email to the user, allowing them to reset their password, security question, and security question answer.

Account not activated

If a user's account status shows that it is pending activation, you can use the Resend Activation Email button to send an email to the user, providing them with a new activation link.

If the user’s account is in a "Pending Approval" status, a Platform Administrator within the account must approve their access request.

Multi-factor authentication issue

If the user has issues with their multi-factor authentication (MFA) configuration or needs to register a new device for MFA, click the Reset MFA button and the user will receive an email letting them know how to reconfigure their MFA settings.

You’re notified in a banner message on the User Management page if a user has conflicting privileges.

You can then take a look at the Conflicts tab to get more details about the type of conflict and a conflict description. There are 3 categories of conflicts: user conflicts, group conflicts, and conflicts associated with insufficient access.

In each conflict scenario, the Rapid7 Command Platform defaults to the principle of least privilege, meaning the user is given the lowest privilege assigned to them until the source of the conflict is resolved.

A user conflict can be caused by:

• Directly assigning a user 2 roles that grant them access to the same feature but with different levels of privilege.
• Directly assigning a user 1 role that has conflicting privileges with a role they inherited from a user group.
• Inheriting roles with conflicting privileges from the same user group (affects all users in the group) or different user groups.

A conflict can occur within a single user group when 2 or more roles within the group contain conflicting privileges. As always, the access level of all users within the group will be based on the principle of least privilege, meaning users will be granted the lowest privilege assigned to them.

You’re notified of an insufficient access conflict when a user does not have the minimum required access for a product they are assigned. Minimum required access is what Rapid7 defines as the least access required for a user to be able to get value from the product they have access to. If these conflicts are not resolved, they impact a user’s ability to get valuable information from the product.

Privilege conflict resolution methods vary by conflict type.

To identify the type of conflict:

1. From the left menu of the Rapid7 Command Platform Home page, click the Administration link.
2. From the left menu of the Administration page, click User Management.
3. Click the Conflicts tab at the top of the panel.
4. You can then view conflicts by type by selecting either the User Conflicts, Group Conflicts, or Insufficient Access tabs.

To resolve user conflicts:

• Edit the roles assigned to a user through individual privileges.
• Edit the user groups a user is a member of.
• Edit the roles assigned to a user group that the user is also a member of.

To resolve group conflicts:

• Edit the roles assigned to a user group.

To resolve insufficient access conflicts:

• Directly assign the appropriate role(s) to a user through individual privileges.
• Edit the user groups a user is a member of so they inherit the appropriate role(s).
• Edit the roles assigned to a user group that the user is also a member of so they inherit the appropriate role(s).