Managing roles
Roles overview
In the context of Tanium™ role-based access control (RBAC), a role assigns grant permissions to specify allowed activities, or deny permissions to specify prohibited activities. You assign roles to the personas of users and user groups to control what users can see and do in the Tanium system.
If you plan to import users and user groups from a Lightweight Directory Access Protocol (LDAP) or Active Directory (AD) server, do so before configuring or assigning roles. For details, see Integrating with LDAP servers.
The Tanium implementation of RBAC supports the following role types:
Advanced roles
Advanced roles grant or deny content set permissions, which control access to sensors, packages, saved questions, and other types of content.
Micro admin roles
Micro admin roles grant or deny permissions that control access to system administration functions of the Tanium Server, such as the Console > Administration > System Status page or API token requests.
Module roles
Module roles grant Tanium solution module permissions, which control access to module workbenches and features. Module roles also grant permissions for module-specific content sets. Module roles do not have deny roles. Users who do not have a role that grants module access cannot access the module workbench or features. Some module permissions automatically enable additional provided permissions. For example, if you select the Patch Module Write permission in a module role, it automatically provides the Ask Dynamic Questions permission.
Reserved roles
The predefined reserved roles assign permissions that enable special-purpose capabilities, such as using the Console > Configuration pages. These special permissions are not available to non-reserved roles. In addition to the special permissions, reserved roles can have some or all of the permissions associated with advanced, micro admin, and module roles.
The following figure shows the configurable components of the different role types, and the order in which you assign them.
For an overview of how roles relate to other RBAC configuration objects such as content sets, personas, users, user groups, and computer groups, see Tanium RBAC implementation and concepts.
Roles have a many-to-many relationship with users and user groups. For example, all Tanium Interact users can have the Interact Show module role, and each of those users can have additional advanced roles that provide access to the sensors and questions that they use in Interact. Similarly, you can configure permissions for the same content set across multiple roles, and each role can specify permissions across multiple content sets.
As a best practice when configuring roles, take full advantage of their modularity and cumulative effect on user permissions. For example, instead of creating a single role with all the permissions that a particular user needs, and creating another role with only slightly different permissions for another user, create several roles with smaller but unique permissions sets. You can then mix and match these minimalistic roles among various users to achieve the same effective permissions as individual roles that have comprehensive permissions. For details, see Effective role permissions.
Roles that assign write permissions, such as Write Package, implicitly assign read permissions, such as Read Package. For details, see Implied role permissions.
Users inherit roles from the user groups to which you assign those users. For details, see Inherited roles.
For a given Tanium Console session, only the permissions of the currently selected persona are available to a user, even if multiple personas are assigned to that user. For details, see Managing personas.
To add, edit, or delete roles, you must have the
Roles do not control access to computer management groups (see Managing computer groups) or action groups (see Managing action groups).
Grant and deny roles
You can assign multiple grant and deny roles to the personas of a user or user group. The Tanium system bases the effective permissions of a persona on the cumulative effect of all the roles assigned to it: all permissions granted or implied, minus those explicitly denied. For details, see Effective role permissions.
In advanced roles, the permission and content set in the deny role must match the permission and content set in the grant role to effectively negate the grant permission.
In the following example, the deny Write Sensor permission on Content Set D does not match any grant permissions, so it has no impact on Erin’s effective permissions.
When you assign content sets to permissions in advanced roles or module roles, the Add all Content Sets that exist or will exist to the permissions option is equivalent to listing each and every content set.
Grant and deny micro admin roles follow the same rules as advanced roles. In the following example, Erin is assigned a grant role with specified permissions, and two deny roles with specified permissions. Exact matches are factored out. Erin has all of the capabilities afforded by the grant role assigned to her, minus the capabilities that are specified in the deny roles that are assigned to her.
Module roles do not have deny roles. You can only grant module access. Users who do not have a role that grants module access cannot access the module workbench or functionality.
Implied role permissions
In grant roles, the write permission implies the read permission.
In deny roles, permissions are not implied. Permissions must be explicitly denied and must exactly match the permission configured in the grant role to be factored out.
Inherited roles
Users inherit role permissions from the personas that are assigned to their user groups.
Reserved roles
The predefined reserved roles assign permissions for special-purpose capabilities, such as using the Console > Configuration pages. The permissions are implicit, so you cannot edit or delete them. The permissions are not available to non-reserved roles. In addition to the special permissions, reserved roles can have some or all of the permissions associated with advanced, micro admin, and module roles. Special logic applies when you assign both a reserved role and non-reserved roles to a user or user group
Admin reserved role
During the setup of your Tanium as a Service (TaaS) deployment, an initial administrator account is created with the Admin reserved role. This role enables the user to access all the features available in TaaS.
Admin role micro admin permissions
By default, the Admin role has the following micro admin permissions. For a description of the permissions, see Table 3.
You cannot assign the permissions that are unique to the Admin role to other micro admin roles.
- Permission Administrator (implies additional permissions: see Permission Administrator)
- Read System Status
- Read Question History
- Read User
- Write User
- Read User Group
- Write User Group
- Read Computer Group
- Write Computer Group
- Read Management Rights (implied and exclusive to Admin)
- Write Management Rights (implied and exclusive to Admin)
- Read Audit
- Use Token
- View Token
- Revoke Token
- Read Action Group
- Write Action Group
- Grant Role (implied and exclusive to Admin)
- Read Persona
- Write Persona
- Read Content Set
- Write Content Set
- Read Global Bandwidth Throttles
- Write Global Bandwidth Throttles
- Read Subnet Bandwidth Throttles
- Write Subnet Bandwidth Throttles
- Read Isolated Subnets
- Write Isolated Subnets
- Read Separated Subnets
- Write Separated Subnets
Admin role advanced permissions
The Admin role has the following implied advanced permissions. For a description of the permissions, see Table 2.
If you customize the Admin role, you cannot remove these permissions.
- Read Sensor
- Read Own Action
- Write Action
- Write Action For Saved Question
- Approve Action
- Bypass Action Approval
- Execute Plugin
- Read Package
- Write Package
- Read Saved Question
- Write Saved Question
- Read Dashboard
- Write Dashboard
- Read Dashboard Group
- Write Dashboard Group
- Read Filter Group
- Write Filter Group
Administrator reserved role
The Administrator role has all permissions to all content, modules, and administrative functionality. When you assign this role, other grant roles are superfluous and deny roles (not including Deny All) are ineffective.
Exception: An advanced role with the Bypass Action Approval permission does have effect when assigned to a user with the Administrator reserved role. The Administrator reserved role does not have this permission by default. Due to the sensitive nature of bypassing approval, you must explicitly assign this permission in all cases.
Content Set Administrator reserved role
The Content Set Administrator role assigns a permission to read and write content set and role configurations, including role assignments within the personas of user and user group configurations. When a persona has this role, any other grant role is ignored. Deny All is the only role that can affect a user with the Content Set Administrator role.
Notice the result when both the Content Set Administrator and Administrator roles are assigned. Only the Content Set Administrator role remains effective. Be careful not to assign the Content Set Administrator role to users who must have other roles. Be careful not to assign (directly or by user group inheritance) the Content Set Administrator role to users who are assigned the Administrator role.
Content Administrator reserved role
The Content Administrator role grants read and write permissions for all content sets, as well as action management permissions. A user with this role can also have grant module roles and micro admin roles. When determining effective permissions, the Tanium system adds grant module roles, factors micro admin roles, and disregards any additional advanced roles.
Deny All reserved role
Users with the Deny All role cannot access anything in the Tanium Core Platform, regardless of any other role that you assign to them, including the
Tasks that require reserved roles
To perform the following tasks, a user must have a reserved role because the tasks are not associated with micro admin permissions that you can assign to micro admin roles.
Effective role permissions
The effective permissions of a user persona are based on the cumulative effect of all the assigned and inherited roles, including the following:
- Permissions specified in grant roles minus permissions specified in deny roles
- Implied permissions in grant roles
- Roles assigned to the persona that a user selects for a Tanium Console session
- Roles inherited from a persona that is assigned to user groups, after the user selects that persona for a Tanium Console session
The user and user group configuration pages have a Roles and Effective Permissions section that clarifies how the Tanium system derives effective permissions.
In the roles section, hover over the tile for an inherited role to see the user group from which it was inherited. Click the tile for a role to highlight the associated permissions in the permissions sections. Click the All Roles tile to redisplay the permissions without highlighting.
Create an advanced role
Advanced roles grant or deny content set permissions, which control access to sensors, packages, saved questions, and other content.
- From the Main menu, select Console > Permissions > Roles.
- Click New Role and then select Grant Advanced Role or Deny Advanced Role to display the role configuration page.
- Specify a configuration Name.
- (Optional) In the All Content Sets Option section, select Add all Content Sets that exist or will exist to the permissions selected below to grant or deny permissions across all existing and future content sets. This option is useful, for example, when you want a user to always be able to read sensors or never be able to write actions.
- In the Ask Dynamic Question section, click Add + to enable users with this role to ask dynamic (ad-hoc) questions.
Ask Dynamic Questions is a global permission. If it is enabled in any role assigned to a user, the user has permission to create dynamic questions that use any of the sensors for which they have read access.
- In the Advanced Permissions section, click Add + to add a permission to the configuration. See Table 2 for descriptions of the permissions.
- Add content sets to each permission. Skip this step if you selected Add all Content Sets that exist or will exist to the permissions selected below.
To create a custom content set without leaving the role configuration page, click Apply New Content Set at the top right of the Advanced Permissions section, click New Content Set, enter a Name and (optional) Description, and click Save.
- Add the same content sets to all permissions: Click Apply New Content Set, select content sets, and click Save.
- Add content sets to a specific permission: Click Add in the permission tile, select content sets, and click Save.
- Save the configuration.
Create a micro admin role
Micro admin roles assign Tanium system administration permissions.
- From the Main menu, select Console > Permissions > Roles.
- Click New Role and then select Grant Micro Admin Role or Deny Micro Admin Role to display the role configuration page.
- Specify a configuration Name.
- Click Add + to add a permission to the configuration. See Table 3 for descriptions of the permissions.
Some administrative tasks in the Tanium Console are not associated with micro admin permissions; only users who have a reserved role can perform these tasks. For details, see Tasks that require reserved roles.
- Save the configuration.
| Permission | Description |
|---|---|
| Permission Administrator | Provides the following micro admin permissions as a bundle:
|
| Read System Status | Can view the Console > Administration > System Status page. |
| Read Question History | Can view the Console > Administration > Question History page. To load and ask a question for the Question History page, the user would also need the underlying content permissions. |
| Read User | Can view the Console > Administration > Users page and view users that are listed on the Console > Administration > User Groups and Permissions > Roles pages. |
| Write User | Can create, modify, and delete user configurations. Implies the Read User permission. |
| Read User Group | Can view the Console > Administration > User Groups page. |
| Write User Group | Can create, modify, and delete user group configurations. Implies the Read User Group permission. |
| Read Computer Group | Can view the Console > Administration > Computer Groups page and Console > Content > Filter Groups page. |
| Write Computer Group | Can create, modify, and delete computer management group and filter group configurations. Implies the Read Computer Group permission.
To create computer groups in which membership is based on a sensor filter, the user also needs the Read Sensor permission on the Reserved content set. The Reserved content set includes content that is used to ask preview questions. Computer groups in which membership is manually defined do not require this permission. |
| Read Management Rights | Can view the computer management group assignments of users, user groups, and personas. This is not an explicit permission. Only the Admin reserved role has this permission. |
| Write Management Rights | Can modify the computer management group assignments of users, user groups, and personas. Implies the Read Management Rights permission. This is not an explicit permission. Only the Admin reserved role has this permission. |
| Read Content Set | Can view the Console > Permissions> Content Sets page. This is not an explicit permission. The Permission Administrator permission implies the Read Content Set permission. |
| Write Content Set | Can create, edit, and delete content sets; move content between content sets; and export content sets. This is not an explicit permission. The Permission Administrator permission implies the Write Content Set permission. |
| Read Role | Can view user role configurations. This is not an explicit permission. This is not an explicit permission. The Permission Administrator permission implies the Read Role permission. |
| Write Role | Can create, edit, and delete user role configurations. This is not an explicit permission. The Permission Administrator permission implies the Write Role permission. |
| Grant Role | Can change the user role assignments of users, user groups, and personas. This is not an explicit permission. The Permission Administrator permission implies the Grant Role permission. |
| Read Global Settings | Can view the Console > Administration > Global Settings page. |
| Write Global Settings | Can create, modify, and delete global settings. Implies the Read Global Settings permission. |
| Read Whitelisted URLs | Can view the Console > Administration > Whitelisted URLs page. |
| Write Whitelisted URLs | Can create, modify, and delete the whitelisted URLs configuration. Implies the Read Whitelisted URLs permission. |
| Read Audit | Can view:
|
| Read Server Status | Can view the https://<Tanium_Server>/info page. For details, see About Us. |
| View Token | Can view the Console > Configuration > Authentication > API Tokens page. |
| Use Token | Can send requests to the Tanium Server for new API tokens. |
| Revoke Token | Can revoke API tokens that are used to access the Tanium Server. |
| Import Signed Content | Can import digitally signed content files. |
| Read Action Group | Can view specific action groups in the Console > Actions > Scheduled Actions page. |
| Write Action Group | Can create, modify, and delete action groups. Implies the Read Action Group permission. |
Create a module role
Module roles grant Tanium solution module permissions, which control access to module workbenches and features. Module roles also grant permissions for module-specific content sets. Module roles do not have deny roles. Users who do not have a role that grants module access cannot access the module workbench or features. Some module permissions enable provided permissions, which a role configuration includes automatically when you select module permissions. For example, if you select the Patch Module Write permission, the role automatically includes the Ask Dynamic Questions permission.
Refer to the module user guides for information about module-specific roles.
| Module | Link |
|---|---|
| Asset | User Guide |
| Client Management | User Guide |
| Comply | User Guide |
| Connect | User Guide |
| Deploy | User Guide |
| Direct Connect | User Guide |
| Discover | User Guide |
| End-User Notifications | User Guide |
| Health Check | User Guide |
| Impact | User Guide |
| Incident Response | User Guide |
| Integrity Monitor | User Guide |
| Interact | User Guide |
| Map | User Guide |
| Network Quarantine | User Guide |
| Patch | User Guide |
| Performance | User Guide |
| Protect | User Guide |
| Reputation | User Guide |
| Reveal | User Guide |
| Threat Response | User Guide |
| Trends | User Guide |
Perform the following steps to create a module role:
- From the Main menu, select Console > Permissions > Roles.
- Click New Role and then select Grant Module Role to display the role configuration page.
- Specify a Name to identify the role.
- (Optional) In the All Content Sets Option section, select Add all Content Sets that exist or will exist to the permissions selected below to grant permissions across all existing and future content sets that are associated with the module. This option applies only to modules such as Trends that have module-specific content.
- In the Module Permissions section, click Add + to add a module to the configuration.
- Click Edit to open the permissions selection box for the module.
- Select permissions and click Save to close the selection box.
- If this role is for a module that has module-specific content, add content sets to each permission. Skip this step if you selected Add all Content Sets that exist or will exist to the permissions selected below.
To create a custom content set without leaving the role configuration page, click Apply New Content Set at the top right of the Module Permissions section, click New Content Set, enter a Name and (optional) Description, and click Save.
- Add the same content sets to all permissions: Click Apply New Content Set, select content sets, and click Save.
- Add content sets to a specific permission: Click Add in the permission tile, select content sets, and click Save.
- Save the configuration.
Assign users and user groups to a role
You can assign users and user groups to roles in the role configuration (as follows) or in the user and user group configurations.
- From the Main menu, select Console > Permissions > Roles.
- Select a role and click Edit to display the role configuration page.
- Click Edit User Assignment to display the Assign Users and User Groups page.
- Next to User Groups, click Edit. Select groups and click Save to close the selection box.
- Next to Users, click Edit. Select users and click Save to close the selection box.
- Click Show Preview to Continue to review the impact of your changes. Review the effective permissions and save the configuration.
- Save your changes.
Clone a role
To add a role that has many settings in common with an existing role, cloning the existing role and then modifying the clone is often a quicker method than configuring a new role. Note that you must still assign users and user groups to the clone, and optionally enter a description; the clone will not inherit those settings from the original role. You can clone any role except the reserved roles.
- From the Main menu, select Console > Permissions > Roles.
- Select a role and click Clone.
- Enter a Name to identify the role, update the permissions as needed, and save your changes.
- Assign users and user groups to the role (see Assign users and user groups to a role).
Export and import roles
Exporting and importing roles is useful when you need to copy the roles between Tanium deployments. For example, you might export roles to a lab deployment for testing before using the roles in a production deployment.
Export all roles
- From the Main menu, select any Console > Content or Console > Permissions page, click Export Content at the top right of the Tanium Console.
- Select Content Sets and Roles, select the Export Format (JSON or XML), and click Export.
- Enter a File Name or use the default name, and then click OK. The Tanium Server exports the content file to the Downloads folder on the system you use to access the Tanium Console.
Export one or more roles
- From the Main menu, select Console > Permissions > Roles.
- Select one or more roles and click Export
. - Enter a File Name or use the default name, and then click OK. The Tanium Server exports the content file to the Downloads folder on the system you use to access the Tanium Console.
Import roles
You can import files that are in JSON or XML format.
- Digitally sign the content file and ensure a public key is in place to validate the signature, as described under Authenticating content files.
- From the Main menu, select any Console > Content or Console > Permissions page and click
Import Content at the top right of the page. - Click Choose File, find and select the configuration file, and click Open.
- Click Import. If object names in the file are the same as for existing objects, the Tanium Console itemizes the conflicts and provides resolution options for each one.
- Select resolutions for any conflicts. For guidance, see Conflicts and Best practices, or consult your TAM.
- Click Import again, and click Close when the import finishes.
Delete a role
When you delete a role configuration, the role is removed from any user and user group configurations that had included it. When deleting a role configuration, we recommend:
- Delete the users and user group assignments from the role configuration.
- Go to the effective permissions page for your users and review the resulting impact on the users' effective permissions.
- Delete the role configuration.
Last updated: 7/2/2020 9:30 AM | Feedback