Account permission reference
All features in Logpresso Sonar are granted different permissions depending on the account type. This table shows the feature permissions for each account type.
The following notation is used for permissions in the table.
| Notation | Meaning |
|---|---|
| R | Short for Read. Permission to view lists and data |
| C | Short for Create. Permission to add data or objects |
| U | Short for Update. Permission to modify or edit data or objects |
| D | Short for Delete. Permission to delete data or objects |
| S | Short for Status. Permission to enable or disable features |
| X | Short for eXecution. Permission to execute features |
Cluster Admin
Cluster Admin has all permissions.
| Menu | Feature | R | C | U | D | S | X | Notes |
|---|---|---|---|---|---|---|---|---|
| Home | - | O | - | - | - | - | - | |
| Intelligence | Security Feed | O | - | - | - | - | - | |
| Intelligence | CVE | O | - | - | - | - | - | |
| Intelligence | CWE | O | - | - | - | - | - | |
| Intelligence | CAPEC | O | - | - | - | - | - | |
| Dashboards | Dashboards | O | O | O | O | - | - | |
| Dashboards | Widgets | O | O | O | O | - | - | |
| Dashboards | User-defined variables | O | O | O | O | - | - | |
| Dashboards | Dashboard sharing | O | O | O | O | O | - | |
| Dashboards | Dashboard publishing | O | O | O | O | O | - | |
| Loggers | Loggers | O | O | O | O | O | - | |
| Loggers | Parsers | O | O | O | O | - | - | |
| Loggers | Log Schemas | O | O | O | O | - | - | |
| Loggers | Logger Models | O | O | O | O | - | - | |
| Analysis | MITRE ATT&CK | O | - | - | - | - | - | |
| Analysis | AI Assistant (chat) | O | O | O | O | - | O | Limited to chats you created |
| Analysis | Event Summary | O | - | - | - | - | - | |
| Analysis | Events | O | - | - | - | - | - | |
| Analysis | Logs | O | - | - | - | - | - | |
| Analysis | Lookup | O | O | O | O | - | - | |
| Analysis | Lookup data | O | O | O | O | - | - | |
| Analysis | Pivots | O | - | - | - | - | - | |
| Analysis | Datasets | O | O | O | O | - | - | |
| Analysis | Queries | O | - | - | - | - | - | Limited to queries you executed |
| Analysis | Scheduled Queries | O | O | O | O | O | O | |
| Analysis | Procedures | O | O | O | O | - | O | |
| Analysis | Reports | O | O | O | O | - | O | |
| Analysis | Data Catalog | O | - | - | - | - | - | |
| Analysis | Glossary | O | O | O | O | - | - | |
| Response | Tickets | O | O | O | O | - | O | |
| Response | Ticket Tags | O | O | O | O | - | - | |
| Response | Ticket Repositories | O | O | O | O | - | - | |
| Response | Explanations | O | O | O | O | - | - | |
| Response | Explanation categories | O | O | O | O | - | - | |
| Response | Response Logs | O | - | - | - | - | - | |
| Response | Playbook History | O | - | - | - | - | - | |
| Response | Approval Requests | O | - | O | - | - | - | |
| Response | Approval Logs | O | - | - | - | - | - | |
| Policies | Stream Rules | O | O | O | O | O | - | |
| Policies | Batch Rules | O | O | O | O | - | O | |
| Policies | Scenario categories | O | O | O | O | - | - | |
| Policies | ML Models | O | O | O | O | - | - | |
| Policies | Threat Intelligence | O | - | - | - | O | - | |
| Policies | Behavior Profiles | O | O | O | O | - | O | |
| Policies | ML Datasets | O | O | O | O | - | - | |
| Policies | Sites | O | O | O | O | - | - | |
| Policies | Assets | O | O | O | O | - | - | |
| Policies | Address Groups | O | O | O | O | - | - | |
| Policies | Subnet Groups | O | O | O | O | - | - | |
| Policies | Port Groups | O | O | O | O | - | - | |
| Policies | User-Defined Filters | O | O | O | O | - | - | |
| Policies | Pattern Groups | O | O | O | O | - | - | |
| Policies | Alarm Groups | O | O | O | O | - | - | |
| Policies | Playbooks | O | O | O | O | O | O | |
| Policies | Indicators | O | O | O | O | - | - | |
| Policies | Signatures | O | O | O | O | - | - | |
| Users | Users | O | O | O | O | - | - | |
| Users | User Groups | O | O | O | O | - | - | |
| Users | Employees | O | O | O | O | - | - | |
| Apps | Apps | O | O | O | O | O | - | |
| Settings | Cluster nodes | O | O | O | O | - | - | |
| Settings | Cluster lifecycle | O | O | O | O | - | - | |
| Settings | Cluster storage | O | O | O | O | - | - | |
| Settings | Sentries | O | O | O | O | - | - | |
| Settings | Performance Monitor | O | - | - | - | - | O | |
| Settings | Tables | O | O | O | O | - | - | |
| Settings | License | O | O | O | O | - | - | |
| Settings | SSO | O | O | O | O | O | - | |
| Settings | Mail Server | O | O | O | O | - | - | |
| Settings | Explanation templates | O | O | O | O | - | - | |
| Settings | Query Monitor | O | O | O | O | - | - | |
| Settings | Audit Logs | O | O | O | O | - | - | |
| Settings | System Logs | O | O | O | O | - | - | |
| Settings | Connect Profiles | O | O | O | O | - | - | |
| Settings | Response Targets | O | O | O | O | O | - | |
| Settings | Certificates | O | O | O | O | - | - | |
| Settings | Packages | O | O | O | O | - | - | |
| Settings | AI Prompts | O | O | O | O | - | - |
Administrator
Administrator has some restricted permissions.
| Menu | Feature | R | C | U | D | S | X | Notes |
|---|---|---|---|---|---|---|---|---|
| Home | - | O | - | - | - | - | - | |
| Intelligence | Security Feed | O | - | - | - | - | - | |
| Intelligence | CVE | O | - | - | - | - | - | |
| Intelligence | CWE | O | - | - | - | - | - | |
| Intelligence | CAPEC | O | - | - | - | - | - | |
| Dashboards | Dashboards | O | O | O | O | - | - | |
| Dashboards | Widgets | O | O | O | O | - | - | |
| Dashboards | User-defined variables | O | O | O | O | - | - | |
| Dashboards | Dashboard sharing | O | O | O | O | O | - | |
| Dashboards | Dashboard publishing | O | O | O | O | O | - | |
| Loggers | Loggers | O | O | O | O | O | - | |
| Loggers | Parsers | O | - | - | - | - | - | |
| Loggers | Log Schemas | O | - | - | - | - | - | |
| Loggers | Logger Models | O | - | - | - | - | - | |
| Analysis | MITRE ATT&CK | O | - | - | - | - | - | |
| Analysis | AI Assistant (chat) | O | O | O | O | - | O | Limited to chats you created |
| Analysis | Event Summary | O | - | - | - | - | - | |
| Analysis | Events | O | - | - | - | - | - | |
| Analysis | Logs | O | - | - | - | - | - | |
| Analysis | Lookup | O | O | O | O | - | - | |
| Analysis | Lookup data | O | O | O | O | - | - | |
| Analysis | Pivots | O | - | - | - | - | - | |
| Analysis | Datasets | O | O | O | O | - | - | |
| Analysis | Queries | O | - | - | - | - | - | Limited to queries you executed |
| Analysis | Scheduled Queries | O | O | O | O | O | O | |
| Analysis | Procedures | O | O | O | O | - | O | |
| Analysis | Reports | O | O | O | O | - | O | |
| Analysis | Data Catalog | O | - | - | - | - | - | |
| Analysis | Glossary | O | O | O | O | - | - | |
| Response | Tickets | O | O | O | O | - | O | |
| Response | Ticket Tags | O | O | O | O | - | - | |
| Response | Ticket Repositories | O | - | - | - | - | - | |
| Response | Explanations | O | O | O | O | - | - | |
| Response | Explanation categories | O | O | O | O | - | - | |
| Response | Response Logs | O | - | - | - | - | - | |
| Response | Playbook History | O | - | - | - | - | - | |
| Response | Approval Requests | O | - | O | - | - | - | |
| Response | Approval Logs | O | - | - | - | - | - | |
| Policies | Stream Rules | O | O | O | O | O | - | |
| Policies | Batch Rules | O | O | O | O | - | O | |
| Policies | Scenario categories | O | O | O | O | - | - | |
| Policies | ML Models | O | O | O | O | - | - | |
| Policies | Threat Intelligence | O | - | - | - | O | - | |
| Policies | Behavior Profiles | O | O | O | O | - | O | |
| Policies | ML Datasets | O | O | O | O | - | - | |
| Policies | Sites | O | O | O | O | - | - | |
| Policies | Assets | O | O | O | O | - | - | |
| Policies | Address Groups | O | O | O | O | - | - | |
| Policies | Subnet Groups | O | O | O | O | - | - | |
| Policies | Port Groups | O | O | O | O | - | - | |
| Policies | User-Defined Filters | O | O | O | O | - | - | |
| Policies | Pattern Groups | O | O | O | O | - | - | |
| Policies | Alarm Groups | O | O | O | O | - | - | |
| Policies | Playbooks | O | O | O | O | O | O | |
| Policies | Indicators | O | O | O | O | - | - | |
| Policies | Signatures | O | O | O | O | - | - | |
| Users | Users | O | O | O | O | - | - | |
| Users | User Groups | O | O | O | O | - | - | |
| Users | Employees | O | O | O | O | - | - | |
| Apps | Apps | O | O | O | O | O | - | |
| Settings | Cluster nodes | - | - | - | - | - | - | |
| Settings | Cluster lifecycle | - | - | - | - | - | - | |
| Settings | Cluster storage | - | - | - | - | - | - | |
| Settings | Sentries | O | O | O | O | - | - | |
| Settings | Performance Monitor | - | - | - | - | - | O | |
| Settings | Tables | O | O | O | O | - | - | |
| Settings | License | - | - | - | - | - | - | |
| Settings | SSO | O | O | O | O | O | - | |
| Settings | Mail Server | - | - | - | - | - | - | |
| Settings | Explanation templates | - | - | - | - | - | - | |
| Settings | Query Monitor | - | - | - | - | - | - | |
| Settings | Audit Logs | - | - | - | - | - | - | |
| Settings | System Logs | - | - | - | - | - | - | |
| Settings | Connect Profiles | O | O | O | O | - | - | |
| Settings | Response Targets | O | O | O | O | O | - | |
| Settings | Certificates | - | - | - | - | - | - | |
| Settings | Packages | - | - | - | - | - | - | |
| Settings | AI Prompts | O | O | O | O | - | - |
User
User has the permissions required for security operations, such as viewing dashboards and handling tickets.
- Through dashboard sharing, users can access dashboards and widgets shared by other users within the granted permissions (view, edit).
- In the Dashboards menu, users can build and share dashboards using tables and widgets they have been granted access to.
- Users cannot access the Loggers or Settings menus.
- All tickets are categorized by ticket repository. Users have permission to add, modify, delete, and execute playbooks for tickets in the repositories assigned to them.
| Menu | Feature | R | C | U | D | S | X | Notes |
|---|---|---|---|---|---|---|---|---|
| Home | - | O | - | - | - | - | - | |
| Intelligence | Security Feed | O | - | - | - | - | - | |
| Intelligence | CVE | O | - | - | - | - | - | |
| Intelligence | CWE | O | - | - | - | - | - | |
| Intelligence | CAPEC | O | - | - | - | - | - | |
| Dashboards | Dashboards | O | O | O | O | - | - | Limited to dashboards with granted access |
| Dashboards | Widgets | O | O | O | O | - | - | Limited to widgets with granted access |
| Dashboards | User-defined variables | O | O | O | O | - | - | |
| Dashboards | Dashboard sharing | O | O | O | O | O | - | |
| Dashboards | Dashboard publishing | - | - | - | - | - | - | |
| Loggers | Loggers | - | - | - | - | - | - | |
| Loggers | Parsers | - | - | - | - | - | - | |
| Loggers | Log Schemas | - | - | - | - | - | - | |
| Loggers | Logger Models | - | - | - | - | - | - | |
| Analysis | MITRE ATT&CK | O | - | - | - | - | - | |
| Analysis | AI Assistant (chat) | O | O | O | O | - | O | Limited to chats you created |
| Analysis | Event Summary | O | - | - | - | - | - | |
| Analysis | Events | O | - | - | - | - | - | |
| Analysis | Logs | O | - | - | - | - | - | |
| Analysis | Lookup | O | O | O | O | - | - | |
| Analysis | Lookup data | O | O | O | O | - | - | |
| Analysis | Pivots | O | - | - | - | - | - | |
| Analysis | Datasets | O | O | O | O | - | - | |
| Analysis | Queries | O | - | - | - | - | - | Limited to queries you executed |
| Analysis | Scheduled Queries | O | O | O | O | O | O | |
| Analysis | Procedures | O | - | - | - | - | O | |
| Analysis | Reports | O | - | - | - | - | O | |
| Analysis | Data Catalog | O | - | - | - | - | - | The User role cannot see the log schema field table |
| Analysis | Glossary | - | - | - | - | - | - | |
| Response | Tickets | O | O | O | O | - | O | Limited to tickets in repositories assigned to you |
| Response | Ticket Tags | O | O | O | O | - | - | |
| Response | Ticket Repositories | O | O | O | O | - | - | |
| Response | Explanations | O | O | O | O | - | - | |
| Response | Explanation categories | - | - | - | - | - | - | |
| Response | Response Logs | O | - | - | - | - | - | |
| Response | Playbook History | O | - | - | - | - | - | |
| Response | Approval Requests | O | - | O | - | - | - | |
| Response | Approval Logs | O | - | - | - | - | - | |
| Policies | Stream Rules | O | - | - | - | - | - | |
| Policies | Batch Rules | O | - | - | - | - | - | |
| Policies | Scenario categories | - | - | - | - | - | - | |
| Policies | ML Models | O | - | - | - | - | - | |
| Policies | Threat Intelligence | O | - | - | - | - | - | |
| Policies | Behavior Profiles | O | - | - | - | - | - | |
| Policies | ML Datasets | O | - | - | - | - | - | |
| Policies | Sites | O | - | - | - | - | - | |
| Policies | Assets | O | - | - | - | - | - | |
| Policies | Address Groups | O | - | - | - | - | - | |
| Policies | Subnet Groups | O | - | - | - | - | - | |
| Policies | Port Groups | O | - | - | - | - | - | |
| Policies | User-Defined Filters | O | - | - | - | - | - | |
| Policies | Alarm Groups | O | - | - | - | - | - | |
| Policies | Pattern Groups | O | - | - | - | - | - | |
| Policies | Playbooks | O | - | - | - | - | O | |
| Policies | Indicators | O | - | - | - | - | - | |
| Policies | Signatures | O | - | - | - | - | - | |
| Users | Users | O | - | - | - | - | - | Limited to viewing your own account, changing password, and managing API keys |
| Users | User Groups | O | - | - | - | - | - | |
| Users | Employees | O | - | - | - | - | - | |
| Apps | Apps | O | - | - | - | - | - | |
| Settings | Cluster nodes | - | - | - | - | - | - | |
| Settings | Cluster lifecycle | - | - | - | - | - | - | |
| Settings | Cluster storage | - | - | - | - | - | - | |
| Settings | Sentries | - | - | - | - | - | - | |
| Settings | Performance Monitor | - | - | - | - | - | - | |
| Settings | Tables | - | - | - | - | - | - | |
| Settings | License | - | - | - | - | - | - | |
| Settings | SSO | - | - | - | - | - | - | |
| Settings | Mail Server | - | - | - | - | - | - | |
| Settings | Explanation templates | - | - | - | - | - | - | |
| Settings | Query Monitor | - | - | - | - | - | - | |
| Settings | Audit Logs | - | - | - | - | - | - | |
| Settings | System Logs | - | - | - | - | - | - | |
| Settings | Connect Profiles | - | - | - | - | - | - | |
| Settings | Response Targets | - | - | - | - | - | - | |
| Settings | Certificates | - | - | - | - | - | - | |
| Settings | Packages | - | - | - | - | - | - | |
| Settings | AI Prompts | - | - | - | - | - | - |