SecMaster Permissions and Supported Actions
This topic describes fine-grained permissions management for your SecMaster. If your account does not need individual IAM users, then you may skip over this section.
By default, new IAM users do not have any permissions assigned. You need to add a user to one or more groups, and assign permissions policies to these groups. Users inherit permissions from the groups to which they are added. After authorization, the user can perform specified operations on cloud services based on the permissions.
You can grant users permissions by using roles and policies. Roles: A type of coarse-grained authorization mechanism that defines permissions related to user responsibilities. Policies: A type of fine-grained authorization mechanism that defines permissions required to perform operations on specific cloud resources under certain conditions.
Limitations and Constraints
All actions supported by SecMaster support only IAM projects but not enterprise projects.
Supported Actions
SecMaster provides system-defined policies that can be directly used in IAM. You can also create custom policies and use them to supplement system-defined policies, implementing more refined access control.
- Permission: A statement in a policy that allows or denies certain operations.
- Action: Specific operations that are allowed or denied.
Permission |
Action |
---|---|
Obtaining a playbook version |
secmaster:playbook:getVersion |
Obtaining indicator details |
secmaster:indicator:get |
Obtaining the resource import template |
secmaster:resource:getTemplate |
Querying alert model details |
secmaster:alertRule:get |
Querying instance topology details |
secmaster:playbook:getInstanceTopology |
Querying data class details |
secmaster:dataclass:get |
Obtaining asset connection details |
secmaster:connection:get |
Obtaining playbooks statistics |
secmaster:playbook:getStatistics |
Exporting indicators |
secmaster:indicator:export |
Obtaining mapping information |
secmaster:mapping:getMapper |
Viewing a report |
secmaster:report:get |
Querying data pipeline details |
secmaster:pipe:get |
Querying alert details |
secmaster:alert:get |
Exporting emergent vulnerabilities |
secmaster:emergencyVulnerability:export |
Querying table details |
secmaster:table:get |
Viewing indicator results |
secmaster:metric:getResult |
Obtaining the category mapping data source |
secmaster:mapping:getDatasource |
Querying instance details |
secmaster:playbook:getInstance |
Obtaining incident details |
secmaster:incident:get |
Obtaining workspace details |
secmaster:workspace:get |
Download an indicator template |
secmaster:indicator:downloadTemplate |
Obtaining workflow details |
secmaster:workflow:get |
Obtaining page details |
secmaster:layout:getWizard |
Obtaining vulnerability group details |
secmaster:vulnerability:getGroup |
Obtaining playbooks operation monitoring data |
secmaster:playbook:getMonitor |
Obtaining field details |
secmaster:dataclass:getField |
Obtaining type details |
secmaster:dataclass:getType |
Obtaining the to-do list details |
secmaster:task:get |
Querying data space details |
secmaster:dataspace:get |
Querying the indicator list |
secmaster:indicator:list |
Querying a layout |
secmaster:layout:get |
Obtaining playbook details |
secmaster:playbook:get |
Viewing agencies |
secmaster:agency:get |
Viewing the subscribed version |
secmaster:subscription:getVersion |
Obtaining layout field details |
secmaster:layout:getField |
Querying search criteria details |
secmaster:searchCondition:get |
Exporting playbooks |
secmaster:playbook:export |
Querying the data pipeline consumption |
secmaster:pipe:getConsumption |
Obtaining workflow version details |
secmaster:workflow:getVersion |
Querying workflow instance topology |
secmaster:workflow:getInstance |
Querying the data pipeline index |
secmaster:pipe:getIndex |
Querying alert template details |
secmaster:alertRuleTemplate:get |
Obtaining category information |
secmaster:mapping:getClassifier |
Viewing resource statistics |
secmaster:resource:getStatistics |
Querying alert types |
secmaster:alert:listTypes |
Searching for an alert list |
secmaster:alert:list |
Querying the table overview |
secmaster:table:listMetrics |
Listing emergency vulnerabilities |
secmaster:emergencyVulnerability:list |
Listing resources |
secmaster:resource:list |
Searching for an incident list |
secmaster:incident:list |
Querying the data distribution histogram |
secmaster:search:listHistograms |
Listing the indicator hits results |
secmaster:metric:listHits |
Querying alert models |
secmaster:alertRule:list |
Obtaining the category mapping function |
secmaster:mapping:listFunctions |
Querying the alert type list |
secmaster:alert:listCategories |
Obtaining a playbook version list |
secmaster:playbook:listVersions |
Querying an alert model overview |
secmaster:alertRule:listMetrics |
Querying the layout list |
secmaster:layout:list |
Listing indicator results |
secmaster:metric:listResults |
Obtaining the layout field list |
secmaster:layout:listFields |
Querying the incident category list |
secmaster:incident:listCategories |
Obtaining data class list details |
secmaster:dataclass:list |
Querying the indicator type list |
secmaster:indicator:listTypes |
Converting an alert into an incident |
secmaster:alert:batchOrders |
Querying the directory list |
secmaster:catalogue:list |
Obtaining the workflow version list |
secmaster:workflow:listVersions |
Querying the workspace list |
secmaster:workspace:list |
Querying data |
secmaster:search:listLogs |
Listing reports |
secmaster:report:list |
Querying the field list |
secmaster:dataclass:listFields |
Querying the search criteria list |
secmaster:searchCondition:list |
Querying data pipelines |
secmaster:pipe:list |
Querying the mapping list |
secmaster:mapping:listMappers |
Querying the vulnerability type list |
secmaster:vulnerability:listType |
Querying the type list |
secmaster:dataclass:listTypes |
Querying the asset connection list |
secmaster:connection:list |
Querying the vulnerability group list |
secmaster:vulnerability:listGroup |
Querying the workflow list |
secmaster:workflow:list |
Querying the review list |
secmaster:playbook:listApproves |
Querying the audit log list of an instance |
secmaster:playbook:getInstanceAuditlog |
Querying an alert template |
secmaster:alertRuleTemplate:list |
Searching for a category mapping list |
secmaster:mapping:list |
Querying the to-do list |
secmaster:task:list |
Querying the instance list |
secmaster:playbook:listInstances |
Querying the data space list |
secmaster:dataspace:list |
Querying a table |
secmaster:table:list |
Querying the alert template overview |
secmaster:alertRuleTemplate:listMetrics |
Searching the object mapping list |
secmaster:dataobject:listRelation |
Obtaining the layout type list |
secmaster:layout:listBusinessTypes |
Obtaining the playbook list |
secmaster:playbook:list |
Obtaining the incident type list |
secmaster:incident:listTypes |
Obtaining a page |
secmaster:layout:listWizards |
Exporting the vulnerability group list |
secmaster:vulnerability:exportGroup |
Permission |
Action |
---|---|
Deleting a page |
secmaster:layout:deleteWizard |
Deleting a data table |
secmaster:table:delete |
Creating a yearly/monthly order |
secmaster:subscription:createPrePaidOrder |
Creating a table |
secmaster:table:create |
Enabling an alert model |
secmaster:alertRule:enable |
Importing a playbook |
secmaster:playbook:import |
Disabling an alert model |
secmaster:alertRule:disable |
Operating a workflow instance |
secmaster:workflow:operateInstance |
Deleting an incident |
secmaster:incident:delete |
Updating an asset connection |
secmaster:connection:update |
Analyzing execution |
secmaster:search:createAnalysis |
Creating object relations |
secmaster:dataobject:createRelation |
Deleting fields |
secmaster:dataclass:deleteField |
Creating an incident |
secmaster:incident:create |
Updating a data class |
secmaster:dataclass:update |
Cloning a playbook version |
secmaster:playbook:copyVersion |
Creating an indicator |
secmaster:indicator:create |
Modifying a table |
secmaster:table:update |
Updating an indicator |
secmaster:indicator:update |
Operating a playbook instance |
secmaster:playbook:operateInstance |
Updating categories |
secmaster:mapping:updateClassifier |
Deleting a workflow |
secmaster:workflow:delete |
Deleting a data pipeline |
secmaster:pipe:delete |
Deleting an object relation |
secmaster:dataobject:deleteRelation |
Deleting a data space |
secmaster:dataspace:delete |
Creating a workflow version |
secmaster:workflow:createVersion |
Deleting a workspace |
secmaster:workspace:delete |
Deleting an alert type |
secmaster:alert:deleteType |
Deleting search criteria |
secmaster:searchCondition:delete |
Importing resources |
secmaster:resource:import |
Updating layout fields |
secmaster:layout:updateField |
Creating data spaces |
secmaster:dataspace:create |
Modifying a vulnerability type |
secmaster:vulnerability:updateType |
Setting the emergency vulnerability read status |
secmaster:emergencyVulnerability:updateReadStatus |
Updating a page |
secmaster:layout:updateWizard |
Updating a data space |
secmaster:dataspace:update |
Creating a report |
secmaster:report:create |
Creating a page |
secmaster:layout:createWizard |
Creating fields |
secmaster:dataclass:createField |
Creating search criteria |
secmaster:searchCondition:create |
Creating a workspace |
secmaster:workspace:create |
Deleting an indicator |
secmaster:indicator:delete |
Updating fields |
secmaster:dataclass:updateField |
Deleting layout fields |
secmaster:layout:deleteField |
Updating data pipelines |
secmaster:pipe:update |
Creating a playbook |
secmaster:playbook:create |
Deleting the data pipeline consumption |
secmaster:pipe:deleteConsumption |
Updating an incident |
secmaster:incident:update |
Modifying an alert model |
secmaster:alertRule:update |
Reviewing a workflow version |
secmaster:workflow:approveVersion |
Deleting an asset connection |
secmaster:connection:delete |
Deleting categories |
secmaster:mapping:deleteClassifier |
Enabling or disabling an alert type |
secmaster:alert:enableType |
Modifying an incident type |
secmaster:incident:updateType |
Updating a workspace |
secmaster:workspace:update |
Deleting a layout |
secmaster:layout:delete |
Deleting an incident type |
secmaster:incident:deleteType |
Review playbooks |
secmaster:playbook:approve |
Updating the data pipeline index |
secmaster:pipe:updateIndex |
Creating a pipeline |
secmaster:pipe:create |
Creating an alert model |
secmaster:alertRule:create |
Deleting a playbook version |
secmaster:playbook:deleteVersion |
Deleting a report |
secmaster:report:delete |
Creating a layout field |
secmaster:layout:createField |
Modifying an alert type |
secmaster:alert:updateType |
Creating an alert |
secmaster:alert:create |
Importing an Indicator |
secmaster:indicator:import |
Updating the workflow version debugging result |
secmaster:workflow:simulate |
Deleting a mapping |
secmaster:mapping:deleteMapper |
Deleting a data class |
secmaster:dataclass:delete |
Updating a directory |
secmaster:catalogue:update |
Updating a report |
secmaster:report:update |
Binding incident types to layouts |
secmaster:incident:bindLayout |
Updating a to-do task |
secmaster:task:update |
Unlocking a table |
secmaster:table:deleteLock |
Enabling/Disabling a vulnerability type |
secmaster:vulnerability:enableType |
Creating an asset connection |
secmaster:connection:create |
Updating a playbook version |
secmaster:playbook:updateVersion |
Creating a vulnerability type |
secmaster:vulnerability:createType |
Deleting an alert model |
secmaster:alertRule:delete |
Deleting a pay-per-use order |
secmaster:subscription:deletePostPaidOrder |
Creating an alert type |
secmaster:alert:createType |
Deleting a category mapping |
secmaster:mapping:delete |
Creating a pay-per-use order |
secmaster:subscription:createPostPaidOrder |
Updating an alert |
secmaster:alert:update |
Simulating an alert model |
secmaster:alertRule:createSimulation |
Associating vulnerability types with layouts |
secmaster:vulnerability:bindLayout |
Creating a playbook version |
secmaster:playbook:createVersion |
Deleting a playbook |
secmaster:playbook:delete |
Deleting a vulnerability type |
secmaster:vulnerability:deleteType |
Creating the data pipeline consumption |
secmaster:pipe:createConsumption |
Creating a workflow |
secmaster:workflow:create |
Verifying a workflow version |
secmaster:workflow:validate |
Updating the category mapping status |
secmaster:mapping:update |
Creating a data class |
secmaster:dataclass:create |
Creating a category |
secmaster:mapping:createClassifier |
Updating a workflow |
secmaster:workflow:update |
Creating a to-do task |
secmaster:task:create |
Creating an incident type |
secmaster:incident:createType |
Deleting an alert |
secmaster:alert:delete |
Deleting a workflow version |
secmaster:workflow:deleteVersion |
Updating a layout |
secmaster:layout:update |
Associating alert types with layouts |
secmaster:alert:bindLayout |
Copying a category mapping |
secmaster:mapping:copy |
Associating indicator types with layouts |
secmaster:indicator:bindLayout |
Enabling or disabling an incident type |
secmaster:incident:enableType |
Updating a workflow version |
secmaster:workflow:updateVersion |
Updating search criteria |
secmaster:searchCondition:update |
Designing a table |
secmaster:table:updateSchema |
Saving as template |
secmaster:layout:createTemplate |
Updating mappings |
secmaster:mapping:updateMapper |
Creating an agency |
secmaster:agency:create |
Locking a table |
secmaster:table:createLock |
Creating a mapping |
secmaster:mapping:createMapper |
Updating a playbook |
secmaster:playbook:update |
Creating a layout |
secmaster:layout:create |
Feedback
Was this page helpful?
Provide feedbackThank you very much for your feedback. We will continue working to improve the documentation.