Roles and Permissions Management

Admin Account Role

The Administrator (Admin) account role is the top-level customer account role for . Users with this role have access to all functions and features, including change management. The following functions can only be performed by users with an Admin account role:

• Add/modify/delete users
• Change account settings
• Assign/reassign Triage Cards to any user
• Data Sources
  • Add/Modify/Delete
  • Download Certificates
• Application Integrations - Add/Delete/Modify
• Rule administration
  • Forescout Rules
    • Enable/disable Forescout rules
    • Add/delete/modify rule parameters
  • Custom Rules - enable/disable a custom rule when the custom rule outcome is trigger detection
• Delete Data Source Connectors
• Restore logs from cold storage

Forescout Cloud Operator Account Role

All other functions are available to the Operator user account role.

Account Administrator Role

The Account Administrator role is provisioned during initial onboarding and is limited to the sole function of adding and managing new accounts for a particular Forescout Cloud instance.

Custom Roles

From the Roles and Permissions view, you can create Custom Roles with individual permissions and data access (attribute) profiles and apply them to both Users and User Groups.

To create a custom role:

1. In User Management, select the Roles and Permissions tab.
2. Click Manage User, and then select Create Role.
3. On the Details tab, provide the following information:
   1. Role Name
   2. Role Description
   3. Product Type
4. On the Permissions tab, you can customize the permissions and access levels for the following features:
   1. Health Monitoring
   2. Asset Management and Monitoring
   3. Integration Management
   4. Access Control Management
   5. Log Monitoring
   6. Dashboards & Reporting Management
   7. Account Management
   8. Incident & Threat Management
   9. Label Management and Assignment
   10. Automation Managment
5. On the Scope tab, you can customize the scope of the data that users have access to, helping limit the amount of information to specific roles, including:
   1. Classification
   2. Datasource. Only the DATASOURCE category is valid for customers.
   3. Deployment
   4. Identity
   5. Medical
   6. Network
6. Click Create Role.

Forescout Cloud User Account Restrictions

For security, compliance, and performance, Forescout does not allow command-line interface (CLI) access to the Platform infrastructure by any customer user account, regardless of role. As a result, Forescout customers do not have the ability to alter logs collected from the customer's environment. Forescout customers also do not have the ability to alter logs through the Platform user interface (UI).