Platform Administration, Access Control, and Support and Services
What this domain tests
Day-to-day administration: identity and role design, least-privilege access, SSO and provisioning, license and platform health, change and upgrade handling, and how to engage support effectively.
Access control design
- Role-based access separates platform administration, content authoring, analyst tiers and read-only audit. Grant the smallest role that lets the person do the job, and scope data access where tenants, business units or regional restrictions apply.
- SSO with SAML against the corporate identity provider, plus MFA, removes local passwords and centralizes deprovisioning. Automated provisioning keeps joiners, movers and leavers in step with HR.
- Service accounts and API tokens belong to integrations and playbooks, not people. Give each its own scoped credential, an owner and a rotation date; a shared token in a playbook is an access review finding waiting to happen.
- Audit the admin action log and run periodic access reviews, especially for roles that can delete data or change retention.
Platform administration
- Monitor ingest against license, collector and connector health, and storage growth.
- Manage content lifecycle: parser updates, rule changes, watchlists. On cloud-native deployments content ships continuously; on self-hosted LogRhythm you plan upgrades and test them, with backups of the Platform Manager configuration and HA for the Data Processor and Indexer.
- Keep an inventory of log sources and owners so a silent source is noticed, not discovered during an incident.
Support and services
Raise cases through the support portal with severity matched to business impact - production loss of detection or ingestion is a high severity, a cosmetic console issue is not. Attach diagnostics, timestamps in UTC, affected source names and reproduction steps; for self-hosted, include the platform logs bundle. Know what sits with support, what with professional services, and what is your own configuration.
Worked example
An analyst who left last quarter is still able to log in via a local account. Reasoning: SSO alone did not cover an account created for a connector test, so deprovisioning missed it. Fix: disable the account, remove its token, add a recurring review of non-SSO accounts, and enforce that integration identities are owned and rotated.
Traps
- Shared admin accounts and standing high privilege for daily work.
- Over-scoped API tokens that are never rotated.
- Skipping change control and backups on self-hosted upgrades.
- Filing a Sev-1-worthy ingestion outage with no diagnostics or time reference.