Users and roles

Administrators manage people under Settings, Users & access. The People table lists every account, including directory and single sign-on accounts, which are created the first time each person signs in.

Roles

A person can hold several roles. Administrators hold every permission.

Role	Can
Everyone signed in	View rule requests, deployments, policy sets, audit findings, device health, regions and IP addressing; download findings as CSV or a PDF report.
Requester	Create, edit, confirm, submit and cancel their own rule requests.
Team lead	Approve or reject approval stages that require Team lead.
Security	Approve or reject stages that require Security; read and export the audit log; run rule audits.
Change board	Approve or reject stages that require Change board.
Implementer	Deploy approved rules and back them out; sync connections; run rule audits; add and edit regions, IP pools and allocations; run health checks now and mute alerts.
Auditor	Read and export the audit log; run rule audits. Can't change anything.
Administrator	Everything above, plus the Settings area.

The What each role can do panel on the same tab summarises this.

Requesters and approval chains

Requesters can never create, change or choose approval chains. Only administrators manage chains, management domain assignments and conditions.

Separation of duties

By default FireSight keeps these apart, whatever roles a person holds:

Requesters can't approve their own requests.
One person can't approve two stages of the same chain.
Anyone who requested, approved, rejected or reviewed a rule can't deploy it.
People who approved or deployed an emergency change can't review it.

Administrators can relax the first three under Settings, Policies & schedules, Approvals, and can also require a different person in each chain. See Settings reference.

Add a user

To add a FireSight account:

Open Settings, Users & access, and click Add user.

Fill in:

Field	Meaning
Username	2 to 150 characters: letters, digits and `_ . @ -`. Can't be changed later.
Display name	The name shown in requests, approvals and the audit log.
Email	Optional.
Initial password	12 or more characters (or the Minimum password length) with three of: lowercase, uppercase, digits, symbols.
Roles	Tick one or more. Requester is ticked by default.

Click Add user.

Edit, reset or disable a user

Click Edit on a row. You can change:

Display name and Email;
Reset password (FireSight accounts only). Leave it empty to keep the current one. Resetting signs the user out everywhere;
Roles. You can't remove the Administrator role from yourself, and FireSight refuses to remove or disable the last administrator;
Account can sign in. Clear it to disable the account. You can't disable yourself.

Click Save user. Saving signs that person out of every session, so they sign in again with the new roles.

The Sign-in column shows Active, Locked (too many failed sign-ins) or Disabled. Unlock appears on locked accounts.

Directory and single sign-on accounts

People who sign in through LDAP, OpenID Connect or SAML get their roles from their groups, mapped under Sign-in methods. The roles are re-read at every sign-in, so a role changed by hand is replaced the next time they sign in.
Their passwords are managed by the directory; Reset password doesn't apply.
A directory or single sign-on account can never take over an existing FireSight account with the same user name.

The scheduler account

firesight-system (shown as FireSight scheduler) is the account scheduled syncs, audits and rule expiry act as, so the audit log shows who did what. It has the Implementer role, no password and no sign-in method, so it can't sign in.