TAP Federated Analyst Limited access allows the user to view data and perform all actions within Helix, except for assigning or editing user permissions and executing regex searches. It also gives the user the federated view and the ability to take actions on behalf of child organizations.
Note
TAP Federated Analyst Limited is a global role, and it cannot be modified or deleted.
Viewing the roles and entitlements
To view the entitlements assigned to the role, filter the list of roles to show only Helix (TAP) roles, and then drill down from the TAP Federated Analyst Limited role to its component entitlements.
Requirements
IAM Admin or IAM User access to the IAM Web UI.
Log in to the IAM Web UI.
Select Organization Settings > Roles. The Roles page lists the IAM global roles and custom roles in your IAM organization.
Filter the list on the Name column, specifying the match string
TAPin all uppercase letters. (The search is case-sensitive.) The list refreshes and shows only the roles that grant access to Helix.Click TAP Federated Analyst (limited) in the Name column.
The Assigned Entitlements panel lists the entitlements assigned to the role.
List of entitlements
The Helix entitlements granted by the global TAP Federated Analyst Limited role are described in the following tables.
Alerts | |
|---|---|
tap.alerts.add | Whether a user can create new alerts |
tap.alerts.browse | Whether a user can browse all alerts |
tap.alerts.edit | Whether a user can edit alerts and their notes |
tap.alerts.hidden | Whether a user can manage hidden alerts |
tap.alerts.read | Whether a user can view all individual alerts and their notes |
Alerts—Federated | |
|---|---|
tap.federated.alerts.add | Whether a user can create new federated alerts |
tap.federated.alerts.browse | Whether a user can browse all alerts aggregated from child organizations |
tap.federated.alerts.edit | Whether a user can edit federated alerts and their notes |
tap.federated.alerts.read | Whether a user can view all individual federated alerts and their notes |
Alert Suppressions | |
|---|---|
tap.alert.suppressions.add | Whether a user can create new alert suppressions |
tap.alert.suppressions.browse | Whether a user can browse all alert suppressions |
tap.alert.suppressions.edit | Whether a user can edit alert suppressions |
tap.alert.suppressions.read | Whether a user can view all individual alert suppressions |
Alert Suppressions—Federated | |
|---|---|
tap.federated.alert.suppressions.add | Whether a user can create new federated alert suppressions |
tap.federated.alert.suppressions.browse | Whether a user can browse all alert suppressions across child organizations |
tap.federated.alert.suppressions.edit | Whether a user can edit federated alert suppressions |
tap.federated.alert.suppressions.read | Whether a user can view all individual federated alert suppressions |
Analytics | |
|---|---|
tap.analytics.browse | Whether a user can browse all analytical advisories |
tap.analytics.edit | Whether a user can edit individual analytical trainings |
Appliance Management | |
|---|---|
tap.appliance.management | Whether a user can access appliance actions and configurations |
Appliances | |
|---|---|
tap.appliances.add | Whether a user can add appliances |
tap.appliances.browse | Whether a user can browse appliances |
tap.appliances.delete | Whether a user can delete appliances |
tap.appliances.edit | Whether a user can edit appliances |
tap.appliances.read | Whether a user can view individual appliance data |
Appliance Groups | |
|---|---|
tap.appliances.groups.add | Whether a user can add appliance groups |
tap.appliances.groups.browse | Whether a user can browse appliance groups |
tap.appliances.groups.delete | Whether a user can delete appliance groups |
tap.appliances.groups.edit | Whether a user can edit appliance groups |
tap.appliances.groups.read | Whether a user can view individual appliance groups |
Appliance Intelligence Feeds | |
|---|---|
tap.appliances.intel_feeds.add | Whether a user can add appliance intel feed data |
tap.appliances.intel_feeds.browse | Whether a user can browse appliance intel feed data |
tap.appliances.intel_feeds.delete | Whether a user can delete appliance intel feed data |
tap.appliances.intel_feeds.edit | Whether a user can edit appliance intel feed data |
tap.appliances.intel_feeds.read | Whether a user can view individual appliance intel feed data |
Archive Searches | |
|---|---|
tap.archivesearch.add | Whether a user can create new archive searches |
tap.archivesearch.admin | Whether a user can modify other users' archive searches |
tap.archivesearch.browse | Whether a user can view all archive searches |
tap.archivesearch.delete | Whether a user can delete archive searches |
tap.archivesearch.edit | Whether a user can edit archive searches |
tap.archivesearch.hidden | Whether a user can manage hidden archive searches |
tap.archivesearch.read | Whether a user can view individual archive searches |
Archive Searches—Federated | |
|---|---|
tap.federated.archivesearch.add | Whether a user can create new federated archive searches |
tap.federated.archivesearch.browse | Whether a user can view all federated archive searches |
tap.federated.archivesearch.delete | Whether a user can delete federated archive searches |
tap.federated.archivesearch.edit | Whether a user can edit federated archive searches |
tap.federated.archivesearch.read | Whether a user can view individual federated archive searches |
Assets | |
|---|---|
tap.assets.add | Whether a user can add assets |
tap.assets.browse | Whether a user can browse assets |
tap.assets.delete | Whether a user can delete assets |
tap.assets.edit | Whether a user can edit assets |
tap.assets.read | Whether a user can view asset data |
Cases—Federated | |
|---|---|
tap.federarated.cases.add | Whether a user can added federated cases |
tap.federated.cases.browse | Whether a user can browse all aggregated cases in child organizations |
tap.federated.cases.delete | Whether a user can delete federated cases |
tap.federated.cases.edit | Whether a user can edit federated cases |
tap.federated.cases.read | Whether a user can view federated cases |
Dashboards | |
|---|---|
tap.dashboards.add | Whether a user can create a new dashboard |
tap.dashboards.admin | Whether a user can modify other users' dashboards |
tap.dashboards.browse | Whether a user can browse all dashboards |
tap.dashboards.delete | Whether a user can delete dashboards |
tap.dashboards.edit | Whether a user can edit dashboards |
tap.dashboards.hidden | Whether a user can manage hidden dashboards |
tap.dashboards.read | Whether a user can view all individual dashboards |
Dashboards—Federated | |
|---|---|
tap.federated.dashboards.add | Whether a user can create a new federated dashboard |
tap.federated.dashboards.browse | Whether a user can browse federated dashboards |
tap.federated.dashboards.delete | Whether a user can delete federated dashboards |
tap.federated.dashboards.edit | Whether a user can edit federated dashboards |
tap.federated.dashboards.read | Whether a user can view all individual federated dashboards |
Events | |
|---|---|
tap.events.browse | Whether a user can browse all events on alerts and incidents |
tap.events.read | Whether a user can view individual events on alerts or incidents |
Incidents | |
|---|---|
tap.incidents.add | Whether a user can create a new incident |
tap.incidents.browse | Whether a user can browse all incidents |
tap.incidents.delete | Whether a user can delete incidents |
tap.incidents.edit | Whether a user can edit incidents and their notes |
tap.incidents.hidden | Whether a user can manage hidden dashboards |
tap.incidents.read | Whether a user can view all individual incidents and their notes |
Indicators | |
|---|---|
tap.indicators.add | Whether a user can create a new indicator |
tap.indicators.browse | Whether a user can browse all indicators |
tap.indicators.delete | Whether a user can delete indicators |
tap.indicators.edit | Whether a user can edit indicators |
tap.indicators.read | Whether a user can view individual indicators |
Intel Feeds—Federated | |
|---|---|
tap.federated.intel_feeds.add | Whether a user can create new federated intel feeds or observables |
tap.federated.intel_feeds.browse | Whether a user can browse all intel feeds or observables propagated from parent and child organizations |
tap.federated.intel_feeds.delete | Whether a user can delete federated intel feeds or observables |
tap.federated.intel_feeds.edit | Whether a user can edit individual federated intel feeds or observables |
tap.federated.intel_feeds.read | Whether a user can view all individual federated intel feeds or observables |
Lists | |
|---|---|
tap.lists.add | Whether a user can create a new customer list |
tap.lists.browse | Whether a user can browse customer lists |
tap.lists.delete | Whether a user can delete customer lists |
tap.lists.edit | Whether a user can edit customer lists |
tap.lists.hidden | Whether a user can mange hidden lists |
tap.lists.read | Whether a user can view individual customer lists |
Packet Capture Jobs | |
|---|---|
tap.pcapjobs.add | Whether a user can create a new PCAP job |
tap.pcapjobs.browse | Whether a user can browse PCAP jobs |
tap.pcapjobs.delete | Whether a user can delete PCAP jobs |
tap.pcapjobs.edit | Whether a user can edit PCAP jobs |
tap.pcapjobs.read | Whether a user can view individual PCAP jobs |
Packet Capture Sensors | |
|---|---|
tap.pcapsensors.add | Whether a user can create a new PCAP sensor |
tap.pcapsensors.browse | Whether a user can browse PCAP sensors |
tap.pcapsensors.delete | Whether a user can delete PCAP sensors |
tap.pcapsensors.edit | Whether a user can edit PCAP sensors |
tap.pcapsensors.read | Whether a user can view individual PCAP sensors |
Policies | |
|---|---|
tap.rbac.policy.add | Whether a user can create new data policies |
tap.rbac.policy.browse | Whether a user can view all data policies |
tap.rbac.policy.constraint.add | Whether a user can create new data policy constraints |
tap.rbac.policy.constraint.browse | Whether a user can view all data policy constraints |
tap.rbac.policy.constraint.delete | Whether a user can delete individual data policy constraints |
tap.rbac.policy.constraint.edit | Whether a user can edit individual data policy constraints |
tap.rbac.policy.constraint.read | Whether a user can view individual data policy constraints |
tap.rbac.policy.delete | Whether a user can delete individual data policies |
tap.rbac.policy.edit | Whether a user can edit individual data policies |
tap.rbac.policy.read | Whether a user can view individual data policies |
tap.rbac.policy.user.browse | Whether a user can view all users assigned to individual data policies |
Reports | |
|---|---|
tap.reports.add | Whether a user can create new reports |
tap.reports.admin | Whether a user can modify other users' reports |
tap.reports.browse | Whether a user can view reports |
tap.reports.delete | Whether a user can delete reports |
tap.reports.edit | Whether a user can edit individual reports |
tap.reports.hidden | Whether a user can manage hidden reports |
tap.reports.read | Whether a user can view individual reports |
Reports—Federated | |
|---|---|
tap.federated.reports.add | Whether a user can create new federated reports |
tap.federated.reports.browse | Whether a user can view federated reports |
tap.federated.reports.delete | Whether a user can delete federated reports |
tap.federated.reports.edit | Whether a user can edit individual federated reports |
tap.federated.reports.read | Whether a user can view individual federated reports |
Rules | |
|---|---|
tap.rules.add | Whether a user can create a new rule |
tap.rules.browse | Whether a user can view rules |
tap.rules.delete | Whether a user can delete rules |
tap.rules.edit | Whether a user can edit rules |
tap.rules.hidden | Whether a user can manage hidden rules |
tap.rules.read | Whether a user can view individual rules and their notes |
Rule Packs | |
|---|---|
tap.rulepacks.add | Whether a user can create new rule packs |
tap.rulepacks.browse | Whether a user can browse rule packs |
tap.rulepacks.delete | Whether a user can delete rule packs |
tap.rulepacks.edit | Whether a user can edit rule packs |
tap.rulepacks.hidden | Whether a user can manage hidden rule packs |
tap.rulepacks.read | Whether a user can view individual rule packs |
Scheduled Searches | |
|---|---|
tap.scheduledsearch.add | Whether a user can create new scheduled searches |
tap.scheduledsearch.admin | Whether a user can modify other users' scheduled searches |
tap.scheduledsearch.browse | Whether a user can browse scheduled searches |
tap.scheduledsearch.delete | Whether a user can delete scheduled searches |
tap.scheduledsearch.edit | Whether a user can edit individual scheduled searches |
tap.scheduledsearch.hidden | Whether a user can manage hidden scheduled searches |
tap.scheduledsearch.read | Whether a user can view individual scheduled searches |
Scheduled Searches—Federated | |
|---|---|
tap.scheduledsearch.add | Whether a user can create new federated scheduled searches |
tap.scheduledsearch.browse | Whether a user can browse federated scheduled searches |
tap.scheduledsearch.delete | Whether a user can delete federated scheduled searches |
tap.scheduledsearch.edit | Whether a user can edit individual federated scheduled searches |
tap.scheduledsearch.read | Whether a user can view individual federated scheduled searches |
Searches | |
|---|---|
tap.search.browse | Whether a user can execute a search |
tap.search.hidden | Whether a user can manage hidden searches |
tap.search.regex | Whether a user can execute a regular expression search |
Searches—Federated | |
|---|---|
tap.federated.search.browse | Whether a user can execute a search across child organizations |
Security Orchestrator | |
|---|---|
tap.security_orchestrator.config.add | Whether a user can add a new device in a playbook |
tap.security_orchestrator.config.browse | Whether a user can browse device configurations |
tap.security_orchestrator.config.delete | Whether a user can delete a device configuration |
tap.security_orchestrator.config.edit | Whether a user can modify device configuration |
tap.security_orchestrator.config.read | Whether a user can read a device configuration |
tap.security_orchestrator.playbook.add | Whether a user can add a new playbook plugin |
tap.security_orchestrator.playbook.browse | Whether a user can browse playbook details and execution results |
tap.security_orchestrator.playbook.delete | Whether a user can delete an existing playbook plugin |
tap.security_orchestrator.playbook.edit | Whether a user can edit a playbook or response action |
tap.security_orchestrator.playbook.execute | Whether a user can execute a playbook |
tap.security_orchestrator.playbook.read | Whether a user can read playbook details and execution results |
tap.security_orchestrator.resources.write | Whether a user can add or edit resources |
Sensors | |
|---|---|
tap.sensors.add | Whether a user can add sensors |
tap.sensors.browse | Whether a user can browse sensor data |
tap.sensors.delete | Whether a user can delete sensors |
tap.sensors.edit | Whether a user can edit sensors |
tap.sensors.read | Whether a user can view individual sensor data |
Threats | |
|---|---|
tap.threats.browse | Whether a user can browse all threats |
tap.threats.read | Whether a user can view all individual threats and notes |
tap.threats.edit | Whether a user can edit all threats and notes |
tap.threats.suppressions.browse | Whether a user can browse all threats suppressions |
tap.threats.suppressions.read | Whether a user can view all individual threats suppressions |
tap.threats.suppressions.edit | Whether a user can edit threats suppressions |
Widgets | |
|---|---|
tap.widgets.add | Whether a user can create a new widget |
tap.widgets.browse | Whether a user can browse widgets |
tap.widgets.delete | Whether a user can delete widgets |
tap.widgets.edit | Whether a user can edit widgets |
tap.widgets.hidden | Whether a user can manage hidden widgets |
tap.widgets.read | Whether a user can view individual widgets |
Widgets—Federated | |
|---|---|
tap.federated.widgets.add | Whether a user can create a new federated widget |
tap.federated.widgets.browse | Whether a user can browse federated widgets |
tap.federated.widgets.delete | Whether a user can delete federated widgets |
tap.federated.widgets.edit | Whether a user can edit federated widgets |
tap.federated.widgets.read | Whether a user can view individual federated widgets |