Manage roles and permissions in

Roles in serve the following purposes:

• Grant users permission to access system functionality, or restrict access to parts of the system.
• Act as a mechanism for grouping users for approvals. See Approve actions before they run in in the Use manual.

View your roles

To view the roles configured in your instance, perform the following steps to access the Roles page:

1. From the Home menu, select Administration.
2. Select User Management > Roles & Permissions.

includes the following default roles that can't be edited or deleted:

Role	Description
Administrator	Users with this role have view, edit, and delete privileges to and can access all functions and settings: By default, the user name associated with the administrator role is soar_local_admin. View, edit, and delete permissions for everything Manage users and accounts Change any and all settings Install or remove apps or connectors Create, edit, and delete Assets Create, edit, delete and view workbooks Create, edit, run, and delete playbooks
Asset Owner	Users with this role can: Create, edit, and delete assets View apps or connectors, events, custom lists, playbooks, system settings, and users and roles.
Automation	This is a service account role used for automated tasks including REST API operations, playbook execution, and ingestion.
Automation Engineer	Users with this role can: View, run, edit playbooks, and can edit playbook code View apps, assets, custom lists, events, system settings, and users and roles
Incident Commander	Users with this role can: Create, edit, and delete cases Create, edit, delete, run, or edit the code for playbooks View and edit events Create, edit, delete and view workbooks View apps, assets, system settings, and users and roles
Observer	Users with this role can view everything except workbooks, but cannot edit or run anything.
OnPrem Broker	This is a service account that allows the Automation Broker to view apps. This role is assigned to a user account with a name that looks like onprem_integration_<auto-generated-id-string>. Onprem_integration users are created when you pair an instance of the Splunk SOAR Automation Broker with your Splunk SOAR (On-premises) deployment. These users do not count against a seat-based license.

Users granted multiple roles have the cumulative privileges of all the roles. You can also restrict access to specific named objects. See Named object permissions.

For deployments using the multitenancy feature, see the section Configure permissions for tenants and assets in Splunk SOAR (On-premises) in Configure multiple tenants on your Splunk SOAR (On-premises) instance.

Add a role to

Perform the following steps to add a new role in :

1. From the Home menu, select Administration.
2. Select User Management > Roles & Permissions.
3. Click + Role.
4. Enter a name for the role.
5. (Optional) Enter a description for the role.
6. Select the Basic Permissions provided by this role.
   

   Component	Permission and Description
   Apps	Select Edit to allow the user to add or delete apps, or edit settings on individual apps. Select View to allow the user to view the list of installed apps, and view the settings for individual apps.
   Assets	Select Delete to allow the user to delete assets. Note that the user will also need view assets in order to see the asset before they can edit it. Select Edit to allow the user add and edit assets. Select View to allow the user the ability to look at the list of assets and individual asset configurations.
   Cases	Select Delete to allow the user to delete cases. Select Edit to allow the user to create and edit cases. Select View to allow the user to view cases.
   Events	Select Delete to allow the user to delete events. Select Edit to allow the user to modify events. This includes data about the event itself (assigned owner, SLA) as well as being able to add items to artifacts and files. Select View to allow the user to view events. This includes both the list of events, as well as the contents of individual events.
   Custom Lists	Select Delete to allow the user to delete custom lists. Select Edit to allow the user to create and edit custom lists. Select View to allow the user to view custom lists.
   Playbooks	Select Delete to allow the user to delete playbooks. Select Edit to allow the user to edit playbooks, including modifying the playbook settings such as logging, active, safe mode, and draft mode. For more information on playbook settings, see Manage settings for a playbook in in the Build Playbooks with the Visual Editor manual. Select View to allow the user to use Action blocks in playbooks. Select Execute to allow the user to execute playbooks on events. Select Edit Code to allow playbook authors to manually edit Python code and customize code blocks. Authors without this permission can only use the visual block editor.
   Workbooks	Select Delete to allow the user to delete workbooks. Note that the user will also need view workbooks in order to see a workbook before they can edit it. Select Edit to allow the user add and edit workbooks. Select View to allow the user the ability to look at the list of workbooks.
   System Settings	Select Edit to allow the user to change System Settings. The System Settings include authentication servers. Users with edit system settings have the ability to perform a privilege escalation attack. Select View to allow the user to view system settings.
   Users and Roles	Select Edit to allow the user to edit, delete and add users and roles. Security note: a user with Edit permission can grant themselves all other privileges. They should be considered equivalent to an administrator. Select View to allow the user to view users and roles, including what role each user has, email addresses, and last login time.

7. Click Label Permissions to configure label permissions for this role. The labels you see in the table depend on the labels you have defined on your instance. See Create additional custom status labels in . The following permissions can be configured:

   Permission	Description
   Delete	The user can delete any object in that has this label. Clicking this automatically grants the Edit and View permissions.
   Edit	The user can edit any object in that has this label. Clicking this automatically grants the View permission.
   View	The user can view any object in with this label, but cannot modify or delete any such objects.

8. Click Repository Permissions to configure repository permissions for this role. The repositories you see in the table depend on the repositories configured on your instance. See Configure a source control repository for your playbooks. The following permissions can be configured:

   Permission	Description
   Delete	The user can delete any playbook in this repository. Clicking this automatically grants the Edit and View permissions.
   Edit	The user can edit any playbook in this repository. Clicking this automatically grants the View permission.
   View	The user can view any playbook in this repository, but cannot modify or delete any playbooks.
   Execute	The user can run any playbook in this repository.

9. Click Create Role.

Add users to a role in

Perform the following steps to add users to a role in :

1. From the Home menu, select Administration.
2. Select User Management > Roles & Permissions.
3. Click the role you want to edit and add users to.
4. Click Add Users.
5. Select a user from the drop-down list, or start typing a username to filter the users that are displayed.
6. Click Add.
7. Repeat and continue adding users as desired. Each time a user is added, the user card appears in the Users field in the role.

Edit a role in

Perform the following steps to edit a role:

1. From the Home menu, select Administration.
2. Select User Management > Roles & Permissions.
3. Select a custom role you want to modify. You can modify any of the permissions in a custom role, add users or remove users. When editing a system role, you can only add or remove users.
   • Users added to a role have their permissions saved in real time, before you click Save Changes.
   • Permission changes to roles are applied in real time to the users who are granted the updated permissions, before you click Save Changes.
   • Users inheriting roles from an SSO provider must log out and log back in to to see their updated permissions.
4. Click Save Changes.

Delete a role in

Perform the following tasks to delete a role in :

1. From the Home menu, select Administration.
2. Select User Management > Roles & Permissions.
3. Click the role you want to delete.
4. Click Delete Role.
5. Click Delete to confirm that you want to delete the role.