AarView Documentation
Version described: 1.78.0 The managed SOC: AarSOC documentation →
Documentation contents

AarView · Configure

Users and roles

Your team and your clients in one instance: the three roles, how an account is attached to a client, service offers, and the actions that need a recent sign-in.

On this page

Your organisation and your clients

An AarView instance belongs to an operator: your organisation. Its short identifier is AARVIEW_OPERATOR_TENANT (by default operator), and its name AARVIEW_OPERATOR_NAME appears on the sign-in page, reports and e-mails.

If you serve other organisations, each one is a client of the instance. An account’s client is an attribute of that account, not an identity provider group. A client account sees only its own client’s data.

The three roles

Roles are cumulative: each can do everything the previous one can.

RoleWhat it adds
Analystdaily work: incidents, alerts, tickets, observable analysis, health of connected sources
Administratorescalating and assigning incidents, reports, their organisation’s audit log, accounts, SOAR rules, read-only collection on a host, quarantining a machine
Super administratorthe instance: clients (onboarding, offboarding, assigning analysts), licence, connected sources, machine access, system health, global audit log

What an account of your team sees:

  • an analyst sees only the clients assigned to them, and none while none is;
  • an administrator of your team sees every client;
  • the super administrator can view as a client: the console shows exactly what that client’s administrator sees, read only. Opening and closing this view are logged.

Operating actions (handling an incident, analysing, collecting, quarantining, writing a SOAR rule, managing the instance) need a role in your organisation. A client’s administrator keeps what concerns their own: its reports, its audit log, its accounts.

Managing accounts

  • Your team creates accounts in Admin > Users, or from a client’s page.
  • A client’s administrator creates, promotes, disables and re-enables their organisation’s accounts in Settings > Users.
  • Each new account gets a single-use link to set its password, with a ready-to-send message in French and English. That link only changes the account it was issued for.
  • Disabling an account closes its sessions and releases its licence seat.

An account AarView did not create (the identity provider’s administrator, for example) is changed in the identity provider; the Settings page says so.

Service offers

Each client is attached to an offer, which decides the features it reaches. The catalogue is edited in Administration > Service offers: each operator defines the offers it sells there, with their capabilities and commitments. An offer cannot grant more than the licence.

A feature the offer does not include shows as locked, with the offer that includes it.

Actions that need a recent sign-in

Creating or changing an account, issuing an access link, licence codes or seats, creating or rotating machine access, a webhook or a connected source, onboarding or offboarding a client, changing an offer and exporting the audit log need a sign-in less than 10 minutes old. Past that, AarView asks you to sign in again (password and code) and brings you back to the page: then repeat the action.

A stolen session cookie is therefore not enough for these actions.