Policies
Define the permission sets of the XPLG console: which components and actions a policy allows, the View-Only baseline, the built-in Administrations policy, and how a user's governing policy is resolved through its groups.
What you will do: write the few policies your organisation needs — a View-Only baseline, one or two operator policies, administration — and know which one applies to a given user.
A policy is a named permission set: the activities (functionalities) that the users and groups assigned to it may perform. It can allow every action in the system, specific components or specific actions, or nothing — a policy with no permission selected is View-Only: the user sees the folders and logs they are allowed to see and can perform no other action. The security baseline on day one is such a restricted View-Only default group; administrative access stays with approved users only.
Create a policy
- Open Security > Policies and choose Add Policy.
- Enter the Policy name (fixed once saved), the Display Name and an optional Description.
- Under Permissions List, select the components or actions the policy allows. Components are grouped by category — Analytics, Monitors, Search and the others — and selecting a parent component allows everything beneath it.
- Save.
Everyday operations
| Task | Where | Notes |
|---|---|---|
| List policies | Security > Policies | |
| View the Administrations policy | View on its row | Read-only; it cannot be modified or removed |
| Modify a policy | Edit on the row: display name, description, permitted actions | The policy name cannot change |
| Remove a policy | Delete on the row, confirm | Only a policy no longer in use |
How the governing policy is resolved
- A user either uses the policy of the groups it belongs to or a policy chosen for the user (set when adding or editing the user).
- A group either uses the policy of the groups it is associated with or a policy chosen for the group.
- A federated user gets the policy of the XPLG group whose name matches one of the user's directory groups; with no policy on that group, the default policy applies.
- Resource permissions then narrow what the policy allows per folder, log, app or AppTag — a policy that permits Search still shows only the logs the user may view. See Folder, log, app and AppTag permissions.
Keep them few and reviewed
Least privilege, need-to-know and segregation of duties govern the model: give each role the narrowest policy that works, keep privileged accounts to the minimum (their activity is logged and alerted separately), review access rights periodically, and revoke on role change or departure. Policies are also what directory groups inherit, so name them by role, not by person.
Next: Folder, log, app and AppTag permissions
Source: XPLG wiki, pages 1594133489, 1594133491, 1594133498, 1594133505, 1594133508, 1594133416, 1594133443, 1594133513, 3161489438 (https://xpolog.atlassian.net/wiki/spaces/XPOL/pages/1594133489).
