Configure Users

Administrator users can use the Users page to add new or manage current (or deleted) Threat Command users, including their own user. You can sort the Users page by the Name, Status, and Last active columns.

Analyst users can use the Settings > My Profile page to configure their user settings.

Use the Users page to configure these user settings:

• Details - Set the user name, contact information, and notifications. You can also set a new user password.
• Permissions - Set which role the user has.
• An admin user has access to all parts of Threat Command. For an analyst user, you can select the parts of the application that each user can access as well as the level of use. For example, which alert types, which permitted actions, and which features of Threat Command Automation (IntSights Extend, Alert Profiler, etc.)
  
• 2FA - Set the two-factor settings, such to enable or disable, the 2FA methods, and backup codes.
  To set 2FA/MFA for users who have been migrated to Rapid7 Platform, see https://docs.rapid7.com/insight/multi-factor-authentication

You can download the details of all users to a CSV file, as described in Download user details.

Users of Okta SSO can also provision users using SAML JIT, as described in Configure Okta SSO.

Add users

You can manually add users. You can also copy a current analyst user and create a new one with identical permissions.

To add a user from scratch:

1. Select Settings > Users > Active.
2. Click  in the lower-right corner of the screen.
3. On the Details tab, type user details.
4. On the Permissions tab, set user type and permissions.
5. On the 2FA tab, select whether this user requires 2-factor authentication.
6. Click Save.

To add an analyst user with identical permissions as an existing analyst user:

1. Select Settings > Users > Active.
2. From the Analysts section of the page, click the copy icon:
   
   If the user is collapsed, hover on their line to show the icon.
   A new user is opened with identical permissions.

Manage active users

You can manage your user as well as the user of other admin or analyst users.

To manage users:

1. Select Settings > Users > Active.
2. Select a user from the Admins or Analysts sections.
   The user record expands.
3. To delete the user, click and confirm the deletion.
4. On the Details tab, you can perform the following activities:

• To set user personal or contact details, type the details.
• To change your password, click Change password.
• To change the password of another user (analyst only, not admin), click Reset User Password.

5. On the Permissions tab, select if the user should be an Admin or Analyst.
   Admin users will have all permissions, and this cannot be changed.
6. For an analyst user, select the permissions to grant the user, then click Save.
7. On the 2FA tab, you can perform the following activities, then click Save:

8. Click Save.
   The user settings are updated.

Delete a user

An admin account can delete any user, except themselves.

When a user is deleted:

• The user remains assigned to closed alerts, enabling you to validate if the alert was handled correctly.
• The user is removed as a watcher from all alerts.

To delete a user:

1. Choose Settings > Users.
   The Active tab shows all active users.
2. Hover over a user name, and click the delete icon at the far right.
   The user is deleted.

Restore deleted users

You can restore users that were previously deleted.

To restore users:

1. Choose Settings > Users> Deleted users.
2. Select users to restore.
3. Click Restore.
   The users are restored to active status.

Download user details

You can download the details of all users to a CSV file, regardless of what their status is.

To download user details:

1. Choose Settings > Users> Deleted users.
2. Click Export CSV.

A CSV file is downloaded to your default download location.