Managing roles

If you plan to import users and user groups from a Lightweight Directory Access Protocol (LDAP) or Active Directory (AD) server, do so before configuring or assigning roles. For details, see Integrating with LDAP servers.

The Tanium implementation of RBAC supports two role categories, which the Administration > Permissions > Roles page distinguishes with an icon in the Role Name column:

Custom roles

You can create, edit, or delete custom roles, which allow or deny any combination of administration, platform content, and module permissions. See Configure a custom role.

System roles

Tanium provides predefined system roles that you cannot edit or delete. These roles include:

• Modules roles: These roles allow or deny permissions for access to module workbenches, features, and content sets. Some module permissions automatically enable additional provided permissions. For example, the Patch Module write permission automatically grants the Ask Dynamic Questions (Interact module) permission.
• Reserved roles: These roles assign permissions for a range of tasks that, in many organizations, are commonly exclusive to a few users. For example, organizations typically have a small set of users who oversee all Tanium operations and require the full administrative permissions that the Administrator reserved role provides. For details, see Reserved roles.

The following figure shows the configurable components of the different role categories, and the order in which you assign the components:

For an overview of how roles relate to other RBAC configuration objects such as content sets, personas, users, user groups, and computer groups, see Tanium RBAC implementation and concepts.

Roles have a many-to-many relationship with users and user groups. For example, all Tanium Interact users can have the Interact Show module role, and each of those users can have additional custom roles that provide access to the sensors and questions that they use in Interact. Similarly, you can configure permissions for the same content set across multiple roles, and each role can specify permissions across multiple content sets.

As a best practice when configuring roles, take full advantage of their modularity and cumulative effect on user permissions. For example, instead of creating a single role with all the permissions that a particular user needs, and creating another role with only slightly different permissions for another user, create several roles with smaller but unique permissions sets. You can then mix and match these minimalistic roles among various users to achieve the same effective permissions as individual roles that have comprehensive permissions. For details, see View effective role permissions.

Some permissions that you assign to a role automatically provide additional permissions. For example, if you assign Package write permission, it implicitly provides Package read permission. For details, see Provided role permissions.

Users inherit roles from the user groups to which you assign those users. For details, see Inherited roles.

For a given Tanium Console session, only the permissions of the currently selected persona are available to a user, even if multiple personas are assigned to that user. For details, see Managing personas.

Allow and deny roles

On the Roles page, the Type column indicates if a role allows or denies permissions. You can assign multiple allow or deny roles to a user or user group. Tanium CloudThe Tanium Server bases the effective permissions of a user or group on the cumulative effect of all the roles that are assigned to that user or group: all explicitly granted or implicitly provided allow permissions minus explicit deny permissions.

You can view the effective permissions of a user or user group in the Tanium Console: see View effective role permissions.

In custom roles, a permission and content set in the deny role must match a permission and content set in the allow role to negate the allow permission. In the following example, the deny Package write permission on Content Set A matches the allow Package write permission on Content Set A, so the allow permission is negated.

In the following example, the deny Package write permission on Content Set D does not match any allow permissions. Therefore, the deny permission has no impact on the effective permissions of the user.

When you assign content sets to permissions in custom roles, the Add all Content Sets that exist or will exist to the permissions option is equivalent to listing every content set. The following figure illustrates an example where the deny Package write permission on Content Set D has an effect.

Allow and deny matching also applies to administration permissions. In the following example, the user has one allow role and two deny roles that specify administration permissions. Tanium CloudThe Tanium Server factors out exact matches between allow and deny permissions. The user has all of the capabilities that the allow role specifies, minus the capabilities that the deny roles specify.

Provided role permissions

Some permissions automatically provide additional permissions because of dependencies. For example, the Package write permission that enables creating packages depends on the Package read permission that enables accessing the Packages page. Similarly, the Interact Execute action permission that enables action deployment depends on the Action write permission that enables action configuration.

In allow roles, every write permission implicitly provides the associated read permission. In the following example, the custom role that is assigned to Eric and Grace has the Package write permission on the specified content sets, and therefore the configuration does not need to specify the Package read permission. A role that has only the Package read permission on the same content set is created for users who must have read-only permissions, like Bob in this example.

Deny roles do not implicitly provide associated permissions. For deny roles to have an effect, they must explicitly specify permissions and those permissions must exactly match the permissions that an allow role specifies. For example, if a deny role specifies that Package write permission is denied on a content set, the role does not also deny Package read permission. In the following example, the deny role permissions do not exactly match any allow role permissions. Therefore, the deny role is disregarded and Bob still has Package read permission on the specified content sets.

Some module permissions and platform content permissions implicitly provide additional permissions because of dependencies that are unrelated to read-write associations. For example, the Interact Execute action permission provides several additional permissions that are required to deploy and configure actions.

Provided permission automatically apply to content set assignments. For example, if you assign the Action write permission to the Base content set, it automatically provides Package read permission for the Base content set. If you assign Sensor write permission to the Default content set, it automatically provides Sensor read permission for the Default content set.

The configuration pages for roles, users, user groups, and personas use different icons to distinguish between explicitly assigned and implicitly provided permissions. See View effective role permissions.

Inherited roles

Users inherit role permissions from their user groups. In the following example, Eric inherits permissions from the roles that are assigned to the NOC user group. He also has permissions that are assigned directly to his user account. Tanium CloudThe Tanium Server enforces the net effect. In this example, even though Eric inherits the Isolated Subnets write permission and Separated Subnets write permission from the user group, the deny role that is assigned directly to his user account negates those permissions. Because no deny roles are assigned to the accounts of Bob and Grace, they have all the permissions that are inherited from the user group, including Isolated Subnets and Separated Subnets write permissions.

Admin reserved role

Assign the Admin reserved role to users who manage all Tanium content, modules, shared services, and administrative functionality.

This role can perform the following tasks:

• Use all Tanium solutions and content

• Configure all Tanium Core Platform settings (such as bandwidth throttles) and customize the Tanium Console

• View, create, edit, delete, and export all RBAC configurations, including users, user groups, personas, roles, computer groups, and API tokens

• View, create, edit, delete, and export all content configurations such as sensors, packages, and scheduled actions

When you assign the Admin role, other allow roles are superfluous and deny roles are ineffective, with the following exceptions:

• Bypass Action Approval: A custom role with the Bypass Action Approval permission does have effect when it is assigned to a user who has the Admin reserved role. The Admin reserved role does not have this permission by default. Due to the sensitive nature of bypassing approval, you must explicitly assign this permission in all cases.
• Deny All: The Deny All reserved role negates all the permissions of the Admin reserved role.

During the setup of your Tanium Cloud deployment, an initial administrator account is created with the Admin role. You can use this account to configure RBAC for all other users, including other users who might need the Admin role.

Administrator reserved role

Assign the Administrator reserved role to users who manage all Tanium content, modules, shared services, and administrative functionality.

This role can perform the following tasks:

• Import, export, update, uninstall, and use all Tanium solutions and content

• Configure all Tanium Core Platform settings (such as bandwidth throttles) and customize the Tanium Console

• Manage the Tanium license and manage trust among platform components (such as Tanium Servers and Zone Servers)

• View, create, edit, delete, import, and export all RBAC configurations, including users, user groups, personas, roles, computer groups, LDAP connections, SAML IdP connections, and API tokens

• View, create, edit, delete, import, and export all content configurations such as sensors, packages, and scheduled actions

When you assign the Administrator role, other allow roles are superfluous and deny roles are ineffective, with the following exceptions:

• Bypass Action Approval: A custom role with the Bypass Action Approval permission does have effect when it is assigned to a user who has the Administrator reserved role. The Administrator reserved role does not have this permission by default. Due to the sensitive nature of bypassing approval, you must explicitly assign this permission in all cases.
• Deny All: The Deny All reserved role negates all the permissions of the Administrator reserved role.

Content Set Administrator reserved role

Assign the Content Set Administrator reserved role to users who manage content set and role configurations.

This role can perform the following tasks:

• View, create, edit, delete, import, or export content set configurations

• Manage content assignments to content sets

• View, create, edit, delete, import, or export user role configurations

• Manage role assignments to users, user groups, and personas

The Content Set Administrator role makes all other allow roles superfluous. The Deny All reserved role is the only role that can affect a user who has the Content Set Administrator role.

Notice the result when both the Content Set Administrator and Administrator roles are assigned. Only the Content Set Administrator role remains effective. Be careful not to assign the Content Set Administrator role to users who must have other roles. Be careful not to assign (directly or by user group inheritance) the Content Set Administrator role to users who are assigned the Administrator role.

Content Administrator reserved role

Assign the Content Administrator reserved role to users who manage content and actions.

This role can perform the following tasks:

• View, create, edit, and delete all content configurations (such as sensors, packages, and saved questions) across all content sets

• View, create, edit, deploy, and delete actions

When the Tanium Server evaluates effective permissions for a user who has the Content Administrator role, the server disregards the content permissions in other roles but evaluates other types of permissions.

Tasks that require reserved roles

To perform the following tasks, a user must have a reserved role because the tasks are not associated with administration permissions that you can assign to custom roles.

 Table 1: Tasks requiring a reserved role

Task	Administrator	Content Administrator	Content Set Administrator
Manage content sets Create, edit, or delete content set configurations.
Manage role configurations and assignments Edit roles and edit the role assignments of users, user groups, and personas.
Manage Tanium solutions Manage Tanium solutions (modules, shared services, and content packs) on the Administration > Configuration > Solutions page.
Manage Tanium Core Platform configuration View or manage many of the Administration > Configuration pages, including those for proxy settings, logging levels, plugins, plugin schedules, sensor threshold indicators, package file repository, Tanium licenses, Tanium root keys, downloads authentication, trust among Tanium Core Platform servers, LDAP servers, SAML, and Tanium Console customizations.

View role details

1. From the Main menu, go to Administration > Permissions > Roles.

   The page displays each role name and category, and the number of users, user groups, and personas to which each role is assigned. The Total Users column indicates the sum of all the users who are assigned the role through their user accounts or who inherit the role from user groups.

2. (Optional) To display attributes that the grid hides by default, click Customize Columns and select the attributes.
3. (Optional) Use the filters to find specific roles:
   • Filter by text: To filter the grid by column values, enter a text string in the Filter items field.
   • Filter by attribute: Filter the grid by one or more attributes, such as the Role Name. Expand the Filters section, click Add, select an attribute and operator, enter a text string that contains all or part of the attribute value, and click Apply. If you add multiple attribute filters, the Boolean AND operator applies. After you finish specifying attributes, click Apply All to filter the grid.
   • Filter by category: By default, the grid shows roles of All categories but you can click a Category button to show only System roles or Custom roles.
   • Filter by type: By default, the grid shows roles of All types but you can click a Type button to show only Allow or Deny roles. See Allow and deny roles.
4. (Optional) View the permissions (and associated content sets), users, and user groups that are assigned to a role by clicking the Role Name.
   To view or edit the configuration of an assigned user or user group, click the user or group name.

   For details about the icons in the Permissions and Content Sets grids, see View effective role permissions.

   To view the roles that are assigned to a persona, see Manage role assignments for a persona.

Configure a custom role

Create or edit a custom role that assigns administration, platform content, or Tanium solution permissions:

1. From the Main menu, go to Administration > Permissions > Roles.
2. Perform one of the following steps:
   • To create a role, click New Role.
   • To edit a role, click a Role Name and click Edit Mode.
3. Specify a Role Name to identify the role.

4. Set the Permission Type to Allow or Deny.

   For details, see Allow and deny roles.

5. Configure the RBAC assignments and permissions as described in the following tasks, and then click Save.

   You configure persona assignments in the persona configuration page instead of the role configuration pages. See Configure role assignments for a persona.

• Manage user assignments for a role

• Manage user group assignments for a role

• Configure role permissions

• Manage content set permissions for a role

Manage user assignments for a role

Skip the first step if you opened the Create Role or Edit Role page in a previous task.

1. From the Main menu, go to Administration > Permissions > Roles, click the Role Name, and click Edit Mode.
2. Expand the Users section, click Manage Users, select or deselect users, and click Select.
   If you are editing a role that already has users assigned, click the number above the Users field in the Role Details section to scroll to the Users section and expand it.

   To view or edit the configuration of a particular user, click the user Name in the Users section. The Edit User page opens in a new tab.

3. Click Save.

Manage user group assignments for a role

Skip the first step if you opened the Create Role or Edit Role page in a previous task.

1. From the Main menu, go to Administration > Permissions > Roles, click the Role Name, and click Edit Mode.
2. Expand the User Groups section, click Manage User Groups, select or deselect groups, and click Select.
   If you are editing a role that already has user groups assigned, click the number above the User Groups field in the Role Details section to scroll to the User Groups section and expand it.

   To view or edit the configuration of a particular user group, click the group Name in the User Groups section. The Edit User Group page opens in a new tab.

3. Click Save.

Manage role permissions

For an overview of how roles determine the effective permissions of users, and to view the permissions and associated content sets that are assigned to a role, see View effective role permissions.

To assign or unassign permissions for a role, see Configure role permissions.

For descriptions of the permissions that you can assign to roles, see:

• Administration permissions

• Solution permissions (such as Interact or Patch permissions)

• Platform content permissions

View effective role permissions

The effective permissions of a user account are based on the cumulative effect of all roles that are assigned to the account or inherited from user groups, including:

• Permissions specified in allow roles minus permissions specified in deny roles
• Implicitly provided permissions in allow roles
• Roles that are assigned to the persona that a user selects for a Tanium Console session. The persona can be assigned directly to the user account or inherited from a user group to which the user belongs.

Perform the following steps to see the effective permissions for a role:

1. From the Main menu, go to Administration > Permissions > Roles, click the Role Name, and click Edit Mode.

2. Review the Permissions and Content Sets. The page displays icons to indicate how permissions are derived:

	Allow permissions that you explicitly assign and that automatically provide additional permissions because of dependencies. For example, when you assign the Interact Module write permission, it automatically provides the Ask Dynamic Questions permission. For details, see Provided role permissions. The icons are grayed out for permissions that are not assigned.
	Allow permissions that you explicitly assign but that do not provide additional permissions. The icons are grayed out for permissions that are not assigned.
	Allow permissions that are implicitly assigned because other permissions provide them. You can hover over the icon to show a tool tip that indicates how the permission was derived from an explicit permission .
	Deny permissions that you explicitly assign.

When you view the configuration page for the Admin reserved rolereserved roles (such as Administrator), it displays a single Special permission under Global Permissions. When you view the configuration page for a custom role, the Global Permissions of the Admin reserved rolereserved roles are hidden because you cannot assign them.

You can expand individual solution content permissions (such as Trends Administrator permission) and Platform Content Permissions (such as Sensor read permission) to see the content sets to which the permission applies. The following icons indicate how content set assignments are derived:

	Content set that is explicitly assigned to the permission.
	Content set that is assigned because another permission implicitly provides it. You can hover over the icon to show a tool tip that indicates how the content set assignment was derived from an explicit permission .
	Content set that is assigned to a deny permission.

To review the effective permissions for a user, user group, or persona, see:

• View effective role permissions for a user
• View effective role permissions for a user group
• View effective role permissions for a persona

Configure role permissions

Perform the following steps to assign or unassign permissions for a role. Skip the first step if you opened the Create Role or Edit Role page in a previous task.

1. From the Main menu, go to Administration > Permissions > Roles, click the Role Name, and click Edit Mode.
2. Expand the section that corresponds to the type of permissions that you want to assign or unassign:

• Administration permissions

• Solution permissions (such as Interact or Patch permissions)

• Platform content permissions

3. Assign or unassign permissions by clicking the appropriate icons in the Special, Read, Write, Execute, or Delete column.

   For details about the icons, see View effective role permissions.

   Click an icon in a column header to select all the permissions of that type. For example, in the Administration permissions header, click the Special icon to assign all the available special administration permissions.

   For the steps to assign content sets to permissions that are associated with content, see Manage content set permissions for a role.

4. (Optional) Review all the permissions that you selected.

   If you are configuring a single role, you can click Preview at the top right of the page to display only the permissions that you selected. When you finish reviewing, click Edit Mode to continue configuring the role.

5. Click Save.

Administration permissions

The following table describes administration permissions.

To create a role that can perform all administrative tasks in the Tanium Console, assign the Permission Administrator permission and the write permissions for User, User Group, Computer Group, and Persona. The Admin reserved role has all these permissions.

Solution permissions

See the following Tanium solution user guides for information about solution-specific permissions. Some of these permissions require content set assignments. See Manage content set permissions for a role.

• API Gateway
• Asset
• Client Management
• Comply
• Connect
• Criticality
• Deploy
• Direct Connect
• Discover
• Endpoint Configuration
• End-User Notifications
• Enforce
• Feed
• Health Check
• Impact
• Integrity Monitor
• Interact
• Map
• Patch
• Performance
• Provision
• Reporting
• Reputation
• Reveal
• Risk
• Threat Response
• Trends

Platform content permissions

The following table describes the permissions for Tanium Core Platform content. After assigning these permissions to a role, you must apply them to content sets. See Manage content set permissions for a role.

Manage content set permissions for a role

When you configure a role with permissions for Tanium solution content (such as Trends Administrator permission) or platform content (such as Sensor read permission), you must assign Content Sets to the pertinent permissions. Skip the first step in this procedure if you opened the Create Role or Edit Role page in a previous task.

1. From the Main menu, go to Administration > Permissions > Roles, click the Role Name, and click Edit Mode.
2. Perform one of the following sub-steps:

• To assign all existing and future content sets to all the pertinent content permissions that you selected, select Add all Content Sets that exist or will exist to the permissions selected above. This option is useful, for example, when you want a user to always be able to read sensors or never be able to write actions, regardless of content set assignments.

• To assign specific content sets to all the pertinent content permissions that you selected, click Apply Content Sets, select the sets, and click Select. The Content Sets selection dialog shows a check mark for any contents sets that are already assigned to all the selected permissions and shows a dash — for content sets that are applied to some (but not all) of the selected permissions.

  Content sets that you assign through the Content Sets selection dialog override content set assignments for individual permissions. For example, if you previously assigned the Interact content set specifically to the Sensor read permission but then deselect that content set during the Apply Content Sets workflow, the Sensor read permission does not apply to the Interact content set.

• To assign specific content sets to a specific permission:

  1. Scroll to the Permissions section and click the number beside the permission icon, such as:

     

  2. Select the content sets and click Select.

     Content sets that you assign to specific permissions are added to any previous assignments. For example, if you assigned the Base content set to all pertinent content permissions (Apply Content Sets workflow) and subsequently assigned the Interact content set specifically to the Sensor read permission, then both the Base and Interact content sets are assigned to the Sensor read permission.

To create a custom content set without leaving the role configuration page, click New Content Set, enter a Name to identify the set, and click Save. You can then assign the new content set to permissions.

3. (Optional) Review the content set assignments.

   The role configuration pages use icons to indicate how permissions and content set assignments are derived. For details, see View effective role permissions.

• To review the content set assignments of a specific permission, expand it in the Permissions section.

• To review the content set assignments for all permissions, see the Content Sets grid.

4. Click Save.

Export and import roles

Copy role configuration details

Copy information from the Roles page to your clipboard to paste the information into a message, text file, or spreadsheet. Each row in the grid is a comma-separated value string.

1. From the Main menu, go to Administration > Permissions > Roles.
2. Perform one of the following steps:
   • Copy row information: Select one or more rows and click Copy .
   • Copy cell information: Hover over the cell, click Options , and click Copy .

Delete a role

Deleting a role removes it from any user, user group, and persona to which it was assigned.

To delete a role:

1. From the Main menu, go to Administration > Permissions > Roles.
2. Select the role and click Delete .