[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-02。"],[[["\u003cp\u003eRole-Based Access Control (RBAC) allows administrators to customize access to Google Security Operations features based on an employee's role.\u003c/p\u003e\n"],["\u003cp\u003eRBAC settings can be modified via the "Users & Groups" page, enabling the assignment of users or groups to roles like Administrator, Editor, Viewer, and ViewerWithNoDetectAccess.\u003c/p\u003e\n"],["\u003cp\u003eAdministrators can manage user and group role assignments, change default roles, and delete users or groups, ensuring at least one administrator with IdP access remains.\u003c/p\u003e\n"],["\u003cp\u003eRoles determine the permissions users have within Google Security Operations, such as the ability to view, modify, or create rules, with predefined roles offering distinct levels of access.\u003c/p\u003e\n"],["\u003cp\u003eThe user's profile page provides details, such as User ID, group ID, and the ability to change their time zone settings for the displayed time in the user interface.\u003c/p\u003e\n"]]],[],null,["# Role-Based Access Control (RBAC) User Guide\n===========================================\n\nSupported in: \nGoogle secops [SIEM](/chronicle/docs/secops/google-secops-siem-toc)\n\nRole-based access control (RBAC) enables an administrator to tailor access to\nGoogle Security Operations features based on an employee's role in your organization.\n| **Important:** This document describes the Google Security Operations roles and groups available in the *Google Security Operations RBAC* feature that does not use IAM for feature access control. If you migrated your instance to IAM, see [Configure feature access control using IAM](/chronicle/docs/onboard/configure-feature-access) and [Google Security Operations permissions in IAM](/chronicle/docs/reference/feature-rbac-permissions-roles).\n\nBefore you begin\n----------------\n\nRBAC reads the group information from the SAML response from the following case-insensitive default attribute names:\n\n- `group`\n- `idpgroup group`\n- `memberof`\n\nIf you use a custom attribute name, it must be provided to your Google Security Operations first to enable you to modify your RBAC settings.\n\nModify RBAC settings\n--------------------\n\nTo navigate to the RBAC profile and settings pages, click **Settings** in the navigation bar.\n\nProfile\n-------\n\nThe **Profile** page displays the information from the user's profile (user ID,\ngroup ID, roles assigned) and some additional information about their organization (customer ID, Google Cloud project number, Google Cloud project ID).\n\n### Customer ID\n\nYour customer ID is located in the **Organization Details** section of the **Profile** page.\n\n### Time zone\n\nYou can change the time zone associated with your profile by clicking **Edit** next to Time Settings. Select the appropriate time zone and click **Save**. This changes the time displayed on most of the user interface to match the selected time zone. While\n| **Note:** Some user interface elements display only UTC time, such as the time values on the prevalence graph in Domain view, which are labeled as **UTC**. Similarly, downloaded results are always displayed in UTC, regardless of the configured time zone.\n\nUsers \\& Groups\n---------------\n\nThe **Users \\& Groups** page enables an administrator to configure RBAC.\n\n1. Click the **Users \\& Groups** link in the left navigation pane. A list of users and groups are displayed on the **Users and groups** page with the columns: **User/Group** , **Type** , and **Assigned role**.\n\n2. Click **Assign new** to open the **Assign role** dialog. From this dialog you can complete the following tasks:\n\n - Assign a new user or users to a role.\n - Assign a new group or groups to a role.\n\n The available roles are:\n - Default\n - ViewerWithNoDetectAccess\n - Viewer\n - Editor\n - Administrator\n\n Once you have added your user or group IDs and selected the appropriate role from the **ASSIGN ROLE** drop-down menu, click **ASSIGN**.\n\n As you assign roles, be aware of the following:\n - When adding users or groups, make sure they exist in your identity provider (IdP). When deleting users or groups, make sure you retain at least one user or group that has the Administrator role and is in your IdP; otherwise, you'll lose administrator access.\n - User and group IdP IDs are case sensitive.\n - You can't change the assigned role of an existing user or group using this dialog. See the steps that follow for how to change roles and delete users and groups.\n - Google Security Operations manages the mapping between users and groups and roles.\n - Use caution if the user or group ID contains special characters that, depending on the text source, might use UTF-8 encoding. Once you click **Assign**, Google recommends that you verify that the new assignment has been saved correctly.\n3. You can change the role of an existing user or group by selecting a new role from the drop-down menu corresponding to that user or group in the **Assigned role** column.\n\n | **Note:** If the administrator has changed a user's role, the user might need to refresh their browser to view the changes.\n4. You can change the default role assigned to new users and groups from the role drop-down menu in the top right corner.\n\n5. You can delete a user or a group by clicking on the trash-can icon which appears on the far right side of the user or group row as you hold the pointer over it.\n\n If you delete users and groups that are administrators, and the only remaining administrators are not in your IDP, you will lose administrator access.\n\n ### Roles\n\nRoles are associated with a set of product permissions. Assigning a role to a user grants the user the permissions associated with that role.\n\nGoogle Security Operations includes the following predefined roles:\n\n- Administrator---Manages the role-based access control policies for your enterprise. Can also edit or view any Google Security Operations page.\n- Editor---Can edit Google Security Operations pages, including the ability to create and edit rules for the Detection Engine.\n- Viewer---Can view any Google Security Operations page, but cannot make any changes.\n- ViewerWithNoDetectAccess---Can view all Google Security Operations pages that don't include detections (principally the Rules and Reference Lists pages).\n\nRBAC applications include the following:\n\n- Create and assign roles based on the job responsibilities.\n- Create and assign roles based on tenancies or organizations.\n- Assign temporary roles to analysts for investigating an issue.\n\n### Permissions\n\nPermissions provide the authorization needed to perform a single controlled action in Google Security Operations, including (see the user interface for the complete list of permissions):\n\n- View rule\n- Modify rule\n- Edit feedback\n- Edit reference list\n- View RBAC permissions\n\nIf a user does not have permissions for an action, the associated feature is disabled. For example, if the user has the Viewer role, they are unable to create a new rule (the **New** button is disabled in the Rules Editor), duplicate a rule (the **Duplicate** option is disabled), or modify an existing rule.\n\nTo view the roles and permissions available to users and groups, complete the following:\n\n1. Click the **Roles** link in the left navigation pane.\n\n2. Select a role from the Roles column to view the permissions granted for that role. The permissions associated with each role cannot be changed.\n\nThe default role for newly added users and groups is Viewer. If you select one of the other roles (for example, Editor), the **Set as default** control becomes available. This lets you to make that role the default instead.\n\n**Need more help?** [Get answers from Community members and Google SecOps professionals.](https://security.googlecloudcommunity.com/google-security-operations-2)"]]
