On an Endpoint Security (HX) appliance, roles have associated capabilities. The functionality provided by each capability and the roles authorized to perform each capability are described in the following table.
In general, if a user is assigned an AAA role that has Web UI access, the actions they can perform occur mostly in the Web UI. In the CLI, only the show commands are available for these roles. The exceptions to this are the admin role (which can perform all available functions in the CLI) and the operator role (which can perform HX appliance software maintenance functions in the CLI, but cannot run CLI commands related to HX Series configuration settings).
If a user is assigned an AAA role that has API access, the actions they can perform occur only in the API. The only exception to this is the fe_services user, who can perform all available functions in the CLI and API, but has no access to the Web UI.
Capability | Description | Authorized AAA roles |
|---|---|---|
Web UI Access | Access the Web UI. Users with auditor roles have access to logs only. Users with monitor roles have access to the Appliance Settings and Health Check, and are able to view Appliance Updates only. | |
API Access | Access the API | |
CLI Access | Access the CLI | admin (full access) analyst ( analyst_sr ( auditor ( fe_services (full access) investigator ( monitor ( operator (appliance image management, |
FireEye as a Service (FaaS) | Manage services | |
Acquisitions (view) | View acquisitions | |
Agent Clone | Manage cloned agents | |
Agent Clone (view) | View cloned agents | |
Agent Configurations | Manage agent configuration settings and deploy them to the agents | admin (Web UI) api_admin (API) operator (Web UI partial) |
Agent Diagnostics | Perform agent diagnostics | |
Agent Diagnostics (view) | View agent diagnostics | |
Alerts | Manage and view alerts | |
Approve Containment | Approve containment requests and stop containment of host endpoints | |
Audit Viewer | Request and view audit data. In the Web UI, this includes processing acquisition data and reviewing it in the Audit Viewer, In the API, this involves searching for audit data in acquisitions using a script. | |
Authentication (AAA) | Maintain authorization settings for user accounts | |
Authentication (AAA) (view) | View authorization settings for user accounts | |
Dashboard | Select links on the Web UI dashboard | |
Dashboard (view) | View the Web UI dashboard | |
Data Acquisitions (Live Response) | Request data acquisitions | |
Enterprise Search | Run enterprise searches | |
File Acquisitions | Request file acquisitions | |
Health Check View | Review system health | |
Hosts | Maintain host lists | |
Hosts (view) | View host lists | |
Host Sets | Maintain host sets | |
Host Sets (view) | View host sets | |
Indicator | Maintain and view indicators and custom indicators | |
Module Administration | Install, uninstall, enable, disable, and upgrade modules | |
Module Data | View module data pages | all roles |
Appliance Licenses | Maintain appliance licenses | |
Appliance Licenses (view) | View appliance licenses | |
Logs | View logs and customize log settings | |
Manage Own Account | Change the password for the specific user account | |
Network | Maintain network settings | |
Network (View) | View network settings | |
PKI | Import and export HX certificates for the agent population | |
Stats | Manage statistics | |
Stats (view) | View statistics | |
Appliance Settings (general) | Perform general system administration functions for the appliance (but not sensitive functions). These include setting the date and time, modifying DTI network settings, managing notifications, modifying network settings, changing certificates and keys, managing appliance licenses, and changing the login banner. | |
Appliance Settings (view) | View appliance settings. | |
Appliance Settings (sensitive) | Perform general and sensitive administrative functions for the appliance. These include managing user accounts (AAA) and appliance backup and restore functionality. | |
System Diagnostics | Perform system diagnostics |