Folder, log, app and AppTag permissions

Scope what each group may see and edit in the XPLG console: View and Edit roles per folder or log, inheritance from the parent folder or the application, what apps and dashboards show, and AppTag-scoped access.

What you will do: decide, per folder, log, application and AppTag, which groups may view and which may edit, and understand what a user sees in Apps and dashboards as a result.

A policy says what a user may do; resource permissions say on which data. For every folder, log and application XPLG lets an administrator choose who sees it and who may edit it, with two roles per member — View and Edit — and three inheritance modes:

Use parent permissions — the folder or log inherits from its parent folder.
Use application permissions — the folder or log takes the permissions of the application (AppTag) it is tagged to.
Use specified permissions — the permissions set on this page apply.

Set permissions on a folder or log

Open Data > Folders and Logs, mark a folder's checkbox and choose Actions > Edit Root Folder's Permissions — it applies to every sub-folder and log beneath it. For a single log, select it and use the Permissions button; in the Log Viewer, right-click a log and choose Edit Permissions.
Choose Use parent permissions or Use specified permissions (or application permissions where the log is tagged).
Under Select Members, move each user or group that may view and edit, and set its role to Edit or View.
Under View Group Members, move each user or group that may only view.
Save.

To segregate business units, applications or customers: remove the All group from the top-level folders, then grant explicit visibility per group — directory groups included, since a group named exactly as in Active Directory receives its members' permissions automatically (see Groups).

Apps and dashboards

Apps and dashboards carry no permissions of their own. Two things decide what a user sees:

the policy — a user whose policy does not allow viewing or editing Apps sees none;
the folder and log permissions — a user allowed to use Apps sees only the apps and dashboards that run on folders and logs the user may view; an app on data the user cannot see is hidden.

Each app or dashboard records the user who created it as its owner, and the back end generates its results as that owner; the owner cannot be changed. Keep the owner's permissions sufficient for every log the app runs on, or the results are generated only in part.

AppTag-scoped permissions

An AppTag is a logical application: a set of folders, logs, accounts, dashboards, saved searches, tasks, templates and other AppTags. Security can be managed at the AppTag level: on the AppTag's Security tab (shown only when security is active) set the view and edit permissions of users and groups for the AppTag, and a user who enters the application under that AppTag's context sees only the members of that AppTag. A folder or log tagged to the application inherits those permissions when it uses application permissions. When the system's User Time Zone Mode is Apply AppTags time zone, each AppTag also carries its own time zone, applied to a user allowed to see that AppTag (several AppTags with different zones fall back to the system time zone).

Next: Active Directory and LDAP