Trellix Wise™ for Private Cloud uses roles and scopes to control user access.
A role is a named collection of scopes that determines the access a user has in Trellix Wise™ for Private Cloud.
A scope defines access to specific pages, features, or actions in the Trellix Wise™ for Private Cloud user interface
Admin
Tenant administrators use the Admin role to configure Trellix Wise™ for Private Cloud for their organization. Admins can perform the following actions:
Configure and review investigations.
Review and manage response actions.
Configure integrations and credentials.
Manage users and roles.
Configure identity providers.
Configure Wise Context.
View dashboards and metrics.
Review tenant audit logs.
Super Admin
Trellix operators use the Super Admin role to manage the Trellix Wise™ for Private Cloud installation. Super Admins have all Admin capabilities plus additional installation-level controls. Super Admins can perform the following actions:
Create and manage tenants.
View service health, pod status, and resource usage.
Configure scheduled database backups and trigger restores for on-premises deployments.
Upload TLS certificates and CA trust bundles for on-premises deployments.
Configure audit log forwarding to an external syslog destination.
View audit logs across tenants.
Import and export the installation configuration for migration and disaster recovery.
Scope-based roles
Regular users receive scope-based roles. Each role combines scopes that grant access to specific features. Users access only the pages and perform only the actions permitted by their assigned scopes. Administrators can assign existing roles or create custom roles.
Illustrative scop-based roles
The following examples show common scope-based role compositions. These are illustrative examples, not seeded defaults.
SOC Analyst: A SOC Analyst investigates threats, reviews investigation results, and performs response activities. A SOC Analyst can perform the following actions:
View AI-generated findings for investigations, evidence, MITRE ATT&CK timelines, and run results.
Assign investigations and set triage status and severity.
Add notes to investigations.
Provide feedback on AI-generated results.
View response actions.
Approve, deny, or stop response actions.
Escalate response actions for review.
Create tickets in connected ticketing systems.
View the Operations dashboard.
Administrators can configure a SOC Analyst role as read-only or with additional scopes for updating investigations and performing response actions.
Threat Hunter: A Threat Hunter searches for potential threats and reviews threat hunting results. A Threat Hunter can perform the following actions:
View investigations and investigation results.
View existing hunts and their results.
Create new hunts.
Edit, pause, and resume existing hunts.
Integration Owner: An Integration Owner configures integrations and the credentials used by integrations. An Integration Owner can perform the following actions:
View available integration types.
View integration configurations.
Create, update, test, and delete integrations.
View integration test results.
View integration usage.
View saved credentials and credential metadata.
View credential values.
Create, update, and delete credentials.
Custom roles: Administrators create custom scope-based roles to meet specific user responsibilities. Custom roles combine scopes for the following areas:
Investigations
Response actions
Threat hunting
Integrations
Credentials
Users and roles
Identity providers
Wise Context
Dashboards and metrics
Audit logs