About administrators

Intelligence Center administrators can configure and manage users to control access to Intelligence Center resources.

They can:

• Create new users.

• Activate them.

• Deactivate them.

• Force a password reset.

• Resend the activation email.

• Unlock locked-out user accounts.

• Promote them to group administrator

• Demote them from group administrator.

Users must belong to at least one user group to be able to access the Intelligence Center.

This is necessary because users inherit their access rights to data sources from the groups they belong to:

• Groups control user access to data sources and to Intelligence Center resources.

• Roles control what actions users are allowed to carry out on the resources they have access to, and where in the Intelligence Center they can perform those actions.

About user access

EclecticIQ Intelligence Center manages and controls resource access and consumption by defining access profiles at different access tiers with the following characteristics:

• Users: individual Intelligence Center consumers.

  They can access the Intelligence Center by signing in with their designated account credentials, such as user name and password.

  Example: mhamilton / Apollo11

• Groups: multiple users brought together under a common umbrella.

  They share the same access rights to selected allowed data sources, such as specific datasets, feeds, enrichers, as well as other groups.

  Example: Threat analysts

  User groups enable controlling user group members’ access to specific Intelligence Center data, assets, and resources through the following mechanisms:

  • Allowed sources: data origins of content stored in the Intelligence Center.

    Selecting an allowed data source for a group means that all group members can access Intelligence Center content that the data source in question is the producer of.

    Data sources can be existing incoming feeds, enrichers, as well as other user groups.

    Example: Entities from Feed A

  • TLP: TLP stands for Traffic Light Protocol.

    TLP color codes flag information to provide handling and sharing guidelines.

    You can assign a TLP color value to restrict access to the following Intelligence Center items:

    • Entities.

    • Data you receive via incoming and send out via outgoing feeds.

    • Data created by users belonging to the groups associated with allowed data sources.

• Roles: the expected functions assigned to an individual user or to a group of users.

  Roles represent sets of actions users can be tasked with.

  Roles group sets of permissions to define the allowed read and modify behaviors that are appropriate to the functions they are related to.

  Example: Team lead

• Permissions: rules and policies constraining user scope.

  Permissions delimit scope by defining the types of action users are authorized to carry out.

  For example: read; modify (that is, create, edit, and delete.)

Write access to user profiles depends on the permissions assigned to a user role.

Usually, admin roles include the modify users permission, and they have read and write access to user profiles.

Non-admin roles should not require this permission: they should be able to edit their own user profiles, and they should access other user profiles in read-only mode.

To manage Intelligence Center users, go to the Users view:

• In the side navigation bar click , and then select User management.

  The default User management view is Users. It shows an overview of the registered Intelligence Center users, with a summary of the basic user details.

View users

The default User management view is Users. It shows an overview of the registered Intelligence Center users with a summary of the basic user details:

• Username: the user name the administrator sets in the field with the same name when creating a new user account.

  User name and password are the necessary sign-in credentials for users to authenticate and to be granted access to the Intelligence Center.

• Status: a user account can have one of the following statuses:

  • Pending: the initial status of a newly created account.

    The account exists, the Intelligence Center sent an account activation email prompting the corresponding user to set a password, but no password has been specified, yet.

    A pending account cannot sign in to access the Intelligence Center.

  • Active: after the user follows up on the activation email and they set a password for their account, the status changes to Active.

    The user can sign in to the Intelligence Center, and they can access assets and resources, based on their role and permissions.

  • Inactive: administrators can deactivate an active account to prevent the corresponding user from accessing the Intelligence Center.

    An inactive account cannot sign in to access the Intelligence Center.

  • Locked: consecutive failed attempts to authenticate and sign in to the Intelligence Center trigger account locking as a security measure against account tampering.

    A locked account cannot sign in to access the Intelligence Center.

    To unlock a locked account, users need to contact the Intelligence Center administrator for assistance.

  • Password reset: the administrator requested the user to reset their password.

    If the user is logged in, they are automatically be logged out. They also receive an email notification with a link to reset their password.

    After resetting the password, the user account status changes to Active.

To view details about a specific user, on the user overview click anywhere in the row corresponding to the user whose profile you want to review.

The user detail pane is displayed.

• The default user detail pane view is Overview, where you can view all the configured options for the current user profile.

• Click History to display an overview in reverse chronological order of the actions performed on the user profile since its creation.

  This reference view enables you to inspect what happened to the user profile (the action), who did it (the user who carried out the action), and when it happened (the date and time).

Create a user

To create a new user:

1. In the side navigation bar click >User management.

2. Click the Users tab, and then click + (Create user) to create a new user.

   The user editor is displayed.

Under Create user, define the following configuration settings:

1. In the First name field, enter the user’s first/given name.

2. In the Last name field, enter the user’s last/family name.

3. In the Username field, enter the designated user name to identify the user when they are signed in to the Intelligence Center.

   The Username field is case-sensitive.

4. In the Email field, enter the user’s valid email address.

   After saving the new user account profile for the first time, the Intelligence Center sends an email notification to the email address specified here.

   The email message notifies the recipient that they have a Intelligence Center account profile whose activation is pending.

   The message also contains a link and instructions for the user to define their password.

   As soon as they set a password, their account status changes from Pending to Active.

5. Optionally, in the Contact info field enter the user’s contact details such as home address or phone number.

6. Optionally, in the PGP public key field enter the user’s PGP public key, if available.

7. From the Locale drop-down menu, select a locale.

   Selecting a Locale allows user to select a timezone from the Preferred timezone drop-down menu.

8. Select the Use system timezone to use the timezone set in Settings ( ) > System settings > General > Timezone.

   When not selected, the Preferred timezone menu appears allowing you to select a specific timezone for selected Locale.

9. In the Groups section, you can add the user to groups, and you can designate them as members or admins of the groups you assign them to.

   Group membership controls user access to Intelligence Center data, assets, and resources.

   Users must belong to at least one user group to be able to access the Intelligence Center data, assets, and resources.

   1. From the Group drop-down menu, select the group you want to add the user to.

   2. From the User type drop-down menu, select whether you want the user to be a Member or a Group admin of the groups they belong to.

      To remove a selection, go to the item(s) you want to remove, and click the cross icon X.

   3. Click + Add or + More to insert new rows or input fields, as necessary, where you can enter additional group membership and user type details.

10. In the Assigned roles section, click the Roles field, and then select one or more available roles from the drop-down menu.

    • Start typing a role name in the autocomplete text input field.

    • Select one or more filtered roles from the matching result list.

    To remove a selection, go to the item(s) you want to remove, and click the cross icon X.

    To remove all selections at once, click the cross icon X next to the drop-down menu arrow in the input field.

    Alternatively, click Unselect all options.

    The Roles field works like Groups, the only difference being that instead of adding the user to one or more groups, this option assigns one or more roles to the user.

    Roles enable controlling what actions users are authorized to carry out in the Intelligence Center, and which Intelligence Center objects they can act on.

11. To access additional save options, click the down arrow on the Save button:

    • Click Save and new to save the current data or configuration for the item you are working on, and to create a new item of the same type right away.

      For example, a new dataset, feed, policy, rule, task, or workspace.

    • Click Save and duplicate to save the current data for the item you are working on, and to create a new prepopulated copy of the same item, which you can use as a template or a blueprint to speed up repetitive manual work.

Edit a user account

1. In the Users view, go to the row of the user you want to modify, click , and select Edit.

   Alternatively:

   Click anywhere in the row corresponding to the user you want to modify, on the top-right corner of the user detail pane click , and then select Edit.

   The Edit user view is displayed.

2. Change the user details as necessary.

3. To store your changes, click Save; to discard them, click Cancel.

Lock a user account

Administrators can configure accounts to automatically lock users out after a predefined number of consecutive unsuccessful sign-in attempts.

This measure prevents account tampering, and it mitigates brute-force attacks.

To set accounts to automatically lock after repeatedly failing to sign in:

1. In the side navigation bar click , select System settings, and then click Account Policy.

2. At the bottom of the Account Policy view, click Edit account policy.

3. In the Edit account policy settings view, edit and set the criteria defining valid passwords, and the account lock policy.

4. Under Locked account, enter an integer in the Maximum of failed attempts field to set the allowed maximum number of failed sign-in attempts for a user account.

   This setting defines how many consecutive failed sign-in attempts users are allowed to attempt before automatically locking their account.

   To unlock a locked account, users need to contact the Intelligence Center administrator for assistance.

Activate your own account

As soon as your user account profile is saved to the Intelligence Center for the first time, you receive an email notification containing:

• An activation link.

• A request to set your password.

Your account only becomes active and ready for use after setting a password.

As long as you do not specify a valid password, your account is inactive, and you cannot use it to sign in and to access the Intelligence Center.

To activate your account and to set your password:

1. Open the notification email containing the activation link.

2. Click the link to follow it.

3. In the Set your password form, enter your password.

4. Enter it again to confirm it.

5. Click Submit.

You can now use your credentials — user name and the specified password — to sign in to the Intelligence Center.

After using the activation link to set the password the link becomes invalid, and you cannot reuse it.

If you click an expired activation link, request a password reset through the Reset password option on the Intelligence Center sign-in view.

Manage your own user profile