Create an automation user group

An automation group should include all the allowed data sources the automation users in the group need to access.

Intelligence Center data sources can be:

• Incoming feeds

• Enrichers

• Groups

To create a new automation user group:

1. In the side navigation bar click > User management.

2. Click the Groups tab, and then click + (Create group) to create a new user group.

   The group editor is displayed.

Under Create group,define the following configuration settings:

1. In the Name field enter a short, clear, and descriptive name to identify the automation user group.

   Example: Integration automation group

2. In the Description field enter a short, free-form description to clarify the purpose and the scope of the automation user group.

   Example: Automation group to integrate and exchange data with external systems and services through incoming and/or outgoing feeds

   Under Allowed sources, click + Add or + More to define the data sources the automation group can access, and the TLP-based access level.

   1. From the Sources drop-down menu, select one or more data sources the automation user group and its members can access to retrieve data from.

      Data sources can be existing incoming feeds and enrichers, as well as existing Intelligence Center user groups.

      If you do not specify any data source, the current group becomes the default allowed data source.

      • Role-based permissions define:

        • The type of actions users are allowed to perform.

        • The type of objects users are allowed to interact with.

      • Group-based Allowed sources and TLP define:

        • Specific Intelligence Center data, assets, and resources users are allowed to access.

   2. From the TLP drop-down menu, select a Traffic Light Protocol color to filter data accordingly.

      Default value: Red

   3. Click + Add or + More to add new rows as needed, where you can enter additional criteria.

3. From the Source reliability drop-down menu, select a reliability value to filter data source by.

   The automation user group is granted access only to data whose source reliability matches the filter value you set here.

4. From the Allowed roles drop-down menu Group admin settings, select one or more roles that group admins can assign to member users of the groups they are admin of.

   Alternatively:

   • Start typing a role name in the autocomplete text input field.

   • Select one or more filtered roles from the matching result list.

   To remove a selection, go to the item(s) you want to remove, and click the cross icon X.

   To remove all selections at once, click the cross icon X next to the drop-down menu arrow in the input field.

   Alternatively, click Unselect all options.

   Group admins can assign to the users of the groups they manage only the role subset you define here.

   This setting protects from unwanted privilege escalation by limiting the set of role-based permissions group admins can grant to their group members.

5. To store your changes, click Save; to discard them, click Cancel.

   To access additional save options, click the down arrow on the Save button:

   • Click Save and new to save the current data or configuration for the item you are working on, and to create a new item of the same type right away.

     For example, a new dataset, feed, policy, rule, task, or workspace.

   • Click Save and duplicate to save the current data for the item you are working on, and to create a new prepopulated copy of the same item, which you can use as a template or a blueprint to speed up repetitive manual work.

Create an automation role

To create a new automation role:

1. In the side navigation bar click > User management.

2. Click the Roles tab, and then click + (Create role) to create a new role.

   The role editor is displayed.

Under Create role, define the following configuration settings:

1. In the Name field, enter a short, clear, and descriptive name to identify the automation role.

   Example: External systems integrator

2. In the Description field, enter a short, free-form description to clarify the purpose and the scope of the automation role.

   Example: Allows implementing data exchange interoperability between the Intelligence Center and an external system.

3. From the Permissions drop-down menu, select the actions the role is allowed to perform, and the Intelligence Center objects the role can act on.

   Alternatively:

   • Start typing a permission name in the autocomplete text input field.

   • Select one or more filtered permissions from the matching result list.

   To remove a selection, go to the item(s) you want to remove, and click the cross icon X.

   To remove all selections at once, click the cross icon X next to the drop-down menu arrow in the input field.

   Alternatively, click Unselect all options.

4. To store your changes, click Save; to discard them, click Cancel.

About permissions

Permission purpose

Permissions provide granular user access control to Intelligence Center functionality, assets, and resources.

Permission names

Permission names are descriptive:

• A verb describes the type of action the permission grants

• A noun or noun phrase describes the Intelligence Center object that the action can be carried out on.

• Format: ${type of action} ${object of the action}

• Example: modify entities

Permission organization

Permissions are grouped in roles.

• Roles act as containers for sets of permissions.

• They define the set of capabilities and actions users can carry out in the Intelligence Center.

• Users can be granted one or more roles.

Permission usage

• Permissions are predefined in the Intelligence Center. They are not editable or configurable.

• You can either grant permissions to, or revoke them from roles.

Permission actions

Permissions allow two types of action:

• Modify: a modification permission that allows to read, create, update, and delete Intelligence Center data.

• Read: a read-only permission that grants access to Intelligence Center data, without allowing any modifications.

View permissions

To display a list of the available Intelligence Center permissions:

1. In the side navigation bar click > User management > Permissions.

2. To sort items by column header:

   • Click the header of the column whose content you want to sort.

   • Click or to sort the content in either ascending or descending order, respectively.

Create an automation user

To create a new automation user:

1. In the side navigation bar click > User management.

   Click the Users tab, and then click + (Create user) to create a new automation user.

   The user editor is displayed.

Under Create user, define the following configuration settings:

1. In the First name field, enter a name that provides a short description of the automation user and its purpose.

   Example: taxii-sync.

2. In the Last name field, enter a name that provides a short description of the automation user and its purpose.

   Example: between-platforms. DOC-8 To Do

3. In the Username field, enter the designated user name to identify the automation user when it is signed in to the Intelligence Center.

   Choose a name that helps understand what the automation user does.

   Example: platform-to-platform-connector; platform-splunk-connector.

4. In the Email field, enter an email address associated with the automation user.

   This is the email address the user activation email is sent to, with further details about setting a password for the user and completing the activation process.

   Active users can sign in to the Intelligence Center and carry out actions, based on their permissions.

   You can use this address to send and to receive automated notifications.

5. You can ignore the Contact info field.

6. Optionally, in the PGP public key field enter the user’s PGP public key, if available.

7. From the Locale drop-down menu, select a locale.

   Selecting a Locale allows user to select a timezone from the Preferred timezone drop-down menu.

8. Select the Use system timezone to use the timezone set in Settings ( ) > System settings > General > Timezone.

   When not selected, the Preferred timezone menu appears allowing you to select a specific timezone for selected Locale.

9. In the Groups section, you can add the user to groups, and you can designate them as members or admins of the groups you assign them to.

   Group membership controls user-access to Intelligence Center data, assets, and resources.

   Users must belong to at least one user group to be able to access the Intelligence Center data, assets, and resources.

   1. From the Group drop-down menu, select the group you want to add the user to.

   2. From the User type drop-down menu, select whether you want the user to be a Member or a Group admin of the groups they belong to.

      To remove a selection, go to the item(s) you want to remove, and click the cross icon X.

   3. Click + Add or + More to insert new rows or input fields, as necessary, where you can enter additional group membership and user type details.

10. In the Assigned roles section, click the Roles field, and then select one or more available roles from the drop-down menu.

    • Start typing a role name in the autocomplete text input field.

    • Select one or more filtered roles from the matching result list.

    To remove a selection, go to the item(s) you want to remove, and click the cross icon X.

    To remove all selections at once, click the cross icon X next to the drop-down menu arrow in the input field.

    Alternatively, click Unselect all options.

    The Roles field works like Groups, the only difference being that instead of adding the user to one or more groups, this option assigns one or more roles to the user.

    Roles enable controlling what actions users are authorized to carry out in the Intelligence Center, and which Intelligence Center objects they can act on.

11. To access additional save options, click the down arrow on the Save button:

    • Click Save and new to save the current data or configuration for the item you are working on, and to create a new item of the same type right away.

      For example, a new dataset, feed, policy, rule, task, or workspace.

    • Click Save and duplicate to save the current data for the item you are working on, and to create a new prepopulated copy of the same item, which you can use as a template or a blueprint to speed up repetitive manual work.

Authentication

The Intelligence Center authentication mechanism is based on JSON Web Token (JWT).

The token header contains an issued-at timestamp, which is used to check token validity.

By default, the token expires 30 minutes after successfully signing in to a Intelligence Center user session.

Before expiring, a pop-up dialog notifies users that their session is about to be terminated.

Users can choose to continue the current session, or to let it expire.

When the token expires the corresponding session is terminated, and users are automatically logged out.

They need to sign back in to the Intelligence Center if they want to resume working.

When users sign out of the Intelligence Center, the JSON web token related to the web session they just terminated is revoked, and it is no longer valid.

This prevents reusing the token for unauthorized access.

When human interaction is detected — for example, keystrokes or mouse activity — the token is automatically refreshed every 60 seconds.

This prevents the system from signing out users who may be working or saving data at that time.

Therefore, the default maximum amount of idle time without any human interaction before being automatically signed out equals to session token validity - 1 minute.

Authenticate

To authenticate and to access the Intelligence Center with user name and password credentials:

1. Make a POST request to the /auth API endpoint.

2. In the request, pass valid username and password authentication credentials as a JSON object to the /auth endpoint.

   The validated credential data is used to generate a Bearer token that is returned with the response.

3. Include the Bearer token value in any subsequent API requests.

4. Pass the token by including an Authorization HTTP header in the API request.

   The Authorization HTTP header has the following format:

   Authorization: Bearer ${token}