Users, Roles, Tenants, and Security Profiles
This domain tests least-privilege access, role composition, and tenant isolation.
Core rules
- Authentication can be local, LDAP/AD, SAML, or PKI. Users inherit permissions from User Roles, which bundle Security Profiles.
- Security Profiles grant granular permissions such as offense access, log activity, rule editing, and admin functions.
- Default roles commonly include Admin, Analyst, and Read Only; clone rather than edit defaults.
- A Tenant isolates data for MSSP-style deployments and is assigned to users. A Domain is a network-hierarchy construct, not a tenant.
- Tenant users see only their tenant's data; a user with no tenant assignment has different visibility.
Worked example
An analyst can view offenses but cannot edit rules. The analyst role lacks the rule-editing security profile. The fix is to assign a role containing that profile, not to grant Admin. After the change, re-login may be required because permissions are evaluated at session start.
Traps
- Treating Domain and Tenant as synonyms.
- Granting Admin for a single missing permission.
- Forgetting the tenant assignment, so the user sees the wrong data.
- Editing a default role and affecting every user.
- Locking out the last admin during LDAP cutover.