Administration, RBAC, and Troubleshooting
The Administration, RBAC, and Troubleshooting domain covers day-to-day administration: users and groups, role-based access control, authentication, auditability, and first-line troubleshooting of agents, brokers, ingestion, and parsers.
Core rules
- RBAC combines a role with a scope. A user may be an analyst in one tenant or instance and have no access in another. Grant the least privilege needed for the queue and data.
- Integrate SAML SSO for authentication and SCIM for user and group lifecycle where supported. Map identity-provider groups to XSIAM roles rather than maintaining local users.
- Audit logs record administrative and security-relevant actions. Use them to investigate permission changes, playbook runs, and data access.
- Troubleshooting follows the path: source, collector, ingestion, parser, detection. Check Broker VM service and connectivity, firewall and syslog configuration, data source status, sample raw events, and parser mappings.
- Monitor license and ingestion limits. A silent data gap can be a quota, credential, or certificate problem, not a detection failure.
Worked example
An analyst reports missing incidents. Check the user's role and scope first; then confirm the incident type is visible and the queue filter is not hiding it. If the user is fine, check whether alerts are arriving: query the raw dataset, inspect the data source health, and verify the Broker VM is receiving syslog. Reasoning: separate access problems from data-pipeline problems before changing rules.
Traps
Granting admin to fix a visibility issue; ignoring scope when troubleshooting; checking only the parser and not the collector; forgetting certificate expiry or credential rotation; using audit logs only for compliance, not troubleshooting; assuming zero alerts means zero data.