Permissions to access data#

The permission structure in EclecticIQ Intelligence Center separates permissions in the following groups:

  • Permissions users require to configure and to manage Intelligence Center settings, features, and functionality.

  • Permissions users require to access and to consume Intelligence Center data.

Actions and permissions to access and consume data#

The following table shows the permissions roles and users require to carry out actions on Intelligence Center data and resources.

Action

Steps

Permissions

View EclecticIQ Intelligence Center dashboard.

In the left navigation bar, select Dashboard Dashboard icon.

  • read entities

  • read extracts

  • read outgoing-feeds

  • read tickets

View ingested entities.

In the left navigation bar, go to Search Search icon > GO TO SEARCH AND BROWSE > Entities.

  • read entities

View an entity detail pane, including any content in the detail pane tabs.

In the left navigation bar, go to Search Search icon > GO TO SEARCH AND BROWSE > Entities, select an entity in the overview, and open the corresponding entity detail pane.

  • read destinations

  • read entities

  • read extracts

  • read history-events

  • read intel-sets

  • read sources

  • read taxonomies

  • read tickets

  • read workspaces

Create a new entity.

Edit an existing entity.

Delete an existing entity.

In the left navigation bar, go to Search Search icon > GO TO SEARCH AND BROWSE > Entities > Create entity + to create a new entity.

  • modify draft-entities (to save as draft)

  • modify entities

  • read extracts

  • read sources

  • read taxonomies

View ingested observables.

In the left navigation bar, go to Search Search icon > GO TO SEARCH AND BROWSE > Observables.

  • read entities

  • read extracts

View an observable detail pane, including any content in the detail pane tabs.

In the left navigation bar, go to Search Search icon > GO TO SEARCH AND BROWSE > Observables, select an observable in the overview.

  • read destinations

  • read entities

  • read extracts

  • read intel-sets

  • read tickets

  • read users

  • read workspaces

Create a new observable.

In the left navigation bar, go to Search Search icon > GO TO SEARCH AND BROWSE > Observables > Create observable +.

  • modify extracts

View manually uploaded files.

In the left navigation bar, go to Search Search icon > GO TO SEARCH AND BROWSE > Uploads.

  • read blob-uploads

View an uploaded file detail pane, including any content in the detail pane tabs.

In the left navigation bar, go to Search Search icon > GO TO SEARCH AND BROWSE > Uploads, click an uploaded file under Recently uploaded files, and open the corresponding uploaded file detail pane.

  • read blob-uploads

  • read content-types

  • read entities

  • read source

  • read users

Manually upload a file.

View an uploaded file detail pane, including any content in the detail pane tabs.

In the left navigation bar, go to Search Search icon > GO TO SEARCH AND BROWSE > Uploads tab, and then manually upload a file; or click an uploaded file under Recently uploaded files to open the corresponding uploaded file detail pane.

  • modify blob-uploads

  • read content-types

  • read entities

  • read groups

View datasets.

In the left navigation bar, go to Search Search icon > GO TO SEARCH AND BROWSE > Datasets.

  • read intel-sets

View a dataset detail pane, including any content in the detail pane tabs.

In the left navigation bar, go to Search Search icon > GO TO SEARCH AND BROWSE > Datasets, select a dataset in the overview, and open the corresponding dataset detail pane.

  • read entities

  • read intel-sets

Create a new dataset.

Edit an existing dataset.

Delete an existing dataset.

In the left navigation bar, go to Search Search icon > GO TO SEARCH AND BROWSE > Datasets > + (Create dataset).

  • modify intel-sets

  • modify workspaces

  • read workspaces

View saved graphs.

In the left navigation bar, go to Graphs Graphs icon > Saved graphs >.

  • read entities

  • read graphs

Create a new graph.

Load an existing graph to view it and to edit it.

Delete an existing graph.

In the left navigation bar, go to Graphs Graphs icon > Saved graphs > Create graph +.

  • modify graphs

  • read entities

  • read workspaces

View entities created with EclecticIQ Intelligence Center entity editor.

In the left navigation bar, go to Search Search icon > GO TO SEARCH AND BROWSE > Entities.

  • read draft-entities

  • read entities

Create a new entity in the entity editor.

Edit an existing entity in the entity editor.

Delete an entity previously created in the entity editor.

In the left navigation bar, select Create + and create a new entity.

  • modify draft-entities

  • modify entities

  • modify extracts

  • read draft-entities

  • read entities

  • read extracts

  • read groups

View newly discovered entities.

In the left navigation bar, go to Discovery Discovery icon.

  • read discovery-rules

  • read entities

  • read source

View exposed entities.

In the left navigation bar, go to Exposure Exposure icon > Entities.

  • read entities

View an exposed entity detail pane, including any content in the detail pane tabs.

In the left navigation bar, go to Exposure Exposure icon > Entities. select an entity in the overview, and open the corresponding entity detail pane.

  • read destinations

  • read entities

  • read extracts

  • read history-events

  • read intel-sets

  • read sources

  • read taxonomies

  • read tickets

  • read workspaces

Edit an existing exposed entity.

Delete an existing exposed entity.

In the left navigation bar, go to Exposure Exposure icon > Entities.

  • modify draft-entities (to save as draft)

  • modify entities

  • read extracts

  • read sources

  • read taxonomies

View exposure settings.

In the left navigation bar, go to Exposure Exposure icon > Settings tab.

  • read configurations

Edit exposure settings.

In the left navigation bar, go to Exposure Exposure icon > Settings tab > Edit exposure settings.

  • modify configurations

View outgoing feed setup for exposure.

In the left navigation bar, go to Exposure Exposure icon > Outgoing feeds tab.

  • read content-type

  • read outgoing feeds

  • read transports

View workspaces.

In the left navigation bar, go to Workspaces Workspaces icon.

  • read graphs

  • read workspaces

Create a new workspace.

Edit an existing workspace.

Delete an existing workspace.

In the left navigation bar, go to Workspaces Workspaces icon > Create workspace +.

  • modify workspaces

Add MITRE ATT&CK classifications to entities.

In the entity builder, select + Add ATT&CK classification.

  • read attack

  • modify entities

View and install knowledge packs.

In the left navigation bar, go to Data configuration Data configuration icon > Knowledge packs.

  • install knowledge-packs

  • read knowledge-packs