Multi-tenant configuration

The Multi-tenancy module provides the following features:

  • Access to specific tabs (e.g. Dashboard, Maps, Status, Alarms, Admin)
  • Ability to apply permissions to User Groups per flow exportering Interface or per device
  • Set permissions to see dashboards and even the ability to manipulate or copy a dashboard
  • Access to administrative functions

The Multi-tenancy module is useful to companies who need to give customers a unique login and restrict what they see. Restrictions can be set on specific devices and or interfaces.

Usergroup permissions

Users are assigned to usergroups. Usergroups are granted permissions. Users inherit permissions from all the usergroups they are a member of. This functionality also serves as the basis for the enterprise focused multi-tenancy functionanlity.

  • New User Groups: Is used to create a new usergroup that individual users can be assigned to. Give the group a name and apply a template from another Usergroup that has similar permissions to the new user group. After creating an account, find the new usergroup on the left and click it to modify.

    Click here for a special note regarding Scrutinizer usergroups and LDAP security groups.

  • Administrators: This is the admin account and cannot be deleted. Users can be assigned to this group and inherit all of its permissions.

  • Guest: This is the default guest account which cannot be deleted. Users can be assigned to this group and will have limited permissions.

Important

Permissions for an individual user account will be inherited from all usergroups it is a member of. To view all the usergroups a user account is a member of, visit Admin tab > Security > Users and click on a user account. Then open the Group Membership tab.

Members

Select the user accounts that will need to have access to this usergroup. A user can be a member of multiple usergroups and inherit all applicable permissions.

Features

Permissions control features the usergroup should have access to within Scrutinizer. Permissions can restrict product features entirely for a usergroup or specific features can be accessed based on your usergroup membership.

Features include:

  • Which tab the members of the usergroup should be able to see,
  • Administrative permissions the usergroup should have access to,
  • Advanced features like acknowledging alarms, scheduling reports, adding/deleting users etc.

Clicking the Configure link in the Features column will provide a click and drag modal to adjust usergroup permissions. Inside that modal, on the left will two radio buttons with Predefined and Advanced labels. The following section describes the difference between the two modes, as you must chose one or the other per group.

Predefined roles vs advanced features

The features modal allows Usergroups to use predefined roles or manually specifiying features. A Usergroup must use either the Predefined Feature sets or the Advanced features that can be manually configured.

Important

You cannot configure manual permissions for a predefined set.

  • Advanced - Manually configure all permissions available. Use Advanced to create custom feature sets.
  • Predefined roles - Feature sets for common persona’s like “ReportUser” or “DashboardAdministrator”
Predefined role Underlying permissions
AlarmsAdministrator ackBBEvent
alarmSettings
almDelete
LogalotPrefs
NotificationManager
PolicyManager
AlarmsUser alarmsTab
DashboardAdministrator dashboardAdmin
DashboardUser createDashTabs
myViewTab
MapsAdministrator mappingGroupConfiguration
mappingObjectConfiguration
MapsUser adminTab
allLogalotReports
mapsTab
reportFilters
statusTab
ReportingAdministrator ApplicationGroups
asnames
deleteReport
HostNames
protocolExclusions
reportSettings
tos
viptelaSettings
wkp
ReportingPowerUser reportFolders
ReportDesigner
saveReport
scheduledReports
srCreate
ReportingUser runReport
SystemAdministrator 3rdPartyIntegration
auditing
auth
Authentication
authLdapServers
awsSettings
changeUserPasswords
createUsers
CrossCheck
DataHistory
deleteUsers
DeviceDetails
EmailNotifications
fa_mgmt_link
faExclusions
feedbackForm
FlowAnalyticsSettings
IPGroups
language
licensing
MACAddresses
ManageCollectors
ManageExporters
proxySettings
radiusConf
sf_asa_acls
SNMPCredentials
sso
syslogNotifications
SystemPreferences
tacacsConf
userAccounts
usergroups
viewUserIdentity
Vitals
  • Device status is used to grant permission to see the status of the device (i.e. Flow exporter). Device icons appear blue in maps if the Device Group permission is granted without this permission.
  • Interface statistics grants permission to see the statistics of an interface.
  • Groups are used to grant permission to see a group (i.e. map). Devices (i.e. flow exporters) appear blue and interfaces black unless permission is granted in Device Status and Interface Statistics.
  • Saved reports allows to select the saved reports/ filters that the usergroup will need to have access to run.
  • Dashboard gadgets selects the gadgets that the usergroup will need to be able to add to dashboards.
  • Third-party links controls the vendor third-party integrations that the usergroup will be able to integrate with.
  • Bulletin boards manages the Bulletin boards that the usergroup will need to be able to access in the Alarms tab.