Adding a new role

Administrator Help | TRITON AP-DATA | Version 8.3.x

Related topics:

Viewing administrators

To define a new role:

Select Settings > Authorization > Roles.

Click New on the Roles page toolbar.

Complete the fields as follows.

Field

Description

Name

Enter a name for the new role

Description

Enter an optional description for the role

Permissions

Select Full Control if you want to give this role complete access to system functions

Select Customized if you want to selectively define the reach of this role into your system.

Status

Select the status reports to which this role should have access:

The Dashboard shows system alerts, statistics, and an incident summary over the last 24 hours.

The System Health screen enables you to monitor the performance of TRITON AP-DATA servers and protectors.

The Endpoint Status screen summarizes the results of endpoint connectivity tests. (Not included in TRITON AP-WEB or TRITON AP-EMAIL.)

The Mobile Status contains details of the traffic being monitored by TRITON AP-DATA over specific periods, such as data that has breached policies and the actions taken.

Reporting

Select the incident and reporting functions that this role should be able to access.

Data Loss Prevention & Mobile

Summary reports - Select this option to give administrators with this role access to data loss prevention summary reports, Incident Risk Ranking report, and My Cases report.

Detail reports - Select this option to give administrators with this role access to data loss prevention incident detail reports. When this option is selected, several more are made available:

View violation triggers - Select this option if you want the administrator to view the values that trigger violations.

View forensics - Select this option if you want the administrator to view forensics for this incident. (Users who aren't allowed to see this confidential data cannot see a preview of the email message or the content of the transaction in other channels.)

Hide source and destination - Select this option if you want to display identification numbers instead of source and destination names. Leaving this unchecked displays source and destinations as names.

Perform operations on incidents - Select this option if you want administrators with this role to be able to perform all escalation, remediation, and workflow operations on data loss prevention or mobile incidents.

Discovery

Not included in TRITON AP-WEB or TRITON AP-EMAIL.

Summary reports - Select this option to give administrators with this role access to discovery summary reports.

Detail reports - Select this option to give administrators with this role access to discovery detail reports. When this option is selected, more are made available:

View violation triggers - Select this option if you want the administrator to view the values that trigger discovery violations.

Perform operations on incidents - Select this option if you want administrators with this role to be able to perform all escalation, remediation, and workflow operations on discovery incidents.

Check the Send email notifications box if you want administrators with this role notified when an incident is assigned to them.

Policy Management

Select the policy management functions this role should be able to perform.

Data loss prevention policies - Can configure DLP policies for all channels as well as content classifiers and resources.

Discovery policies - Can configure discovery policies, tasks, content classifiers, and resources.

Sample database records - Can view sample database information when editing a database fingerprinting classifier, including database, Salesforce, and CSV classifiers.

This is offered on the Field Selection page of the fingerprinting wizard when you define the records to fingerprint. It allows you to verify that you've set up the classifier as intended. See Database Fingerprinting Wizard - Field Selection for more details.

Administrators can always view sample data when creating a new classifier, but you may not want all administrators to view data set up by others. If you de-select this box, this option is grayed out for administrators with this role.

Logs

Select the logs to which this role should have access:

The Traffic log contains details of the traffic being monitored by TRITON AP-DATA over specific periods, such as data that has breached policies and the actions taken.

The System log displays system events sent from different Forcepoint components, for example TRITON AP-DATA servers, protectors, or policy engines.

The Audit log displays actions performed by administrators in the system.

Settings

Select which options in the Configuration area of Settings administrators with this role should be able to access.

General

Services - Administrators can configure local and external services like Linking Service.

Archive Partitions - Administrators can select incident partitions, then archive, restore or delete them.

Policy Updates - Administrators can update predefined policies to the latest version.All other general settings

All other general settings - Administrators can configure all other settings under Settings > General.

Authorization - Administrators can configure TRITON AP-DATA authorization settings.

Deployment

Select which functions administrators with this role should be able to perform.

Manage system modules - Give this role the ability to register modules with the TRITON management server.

Manage endpoint profiles - Give this role the ability to view and edit endpoint profiles. Administrators can add new endpoint profiles, delete profiles, and rearrange their order. (Not included in TRITON AP-WEB or TRITON AP-EMAIL.)

Deploy settings - Give this role the ability to deploy configuration settings to all system modules.

Click OK to save your changes.