Community
Questions Library
Docs
Blog
Events
Swag
Github
Slack
JupiterOne
Discussions
Release Notes
Contact Us
JupiterOne Access Controls - AskJ1 Community
<main> <article class="userContent"> <p>Each JupiterOne account has one of the following two access control configurations:</p> <ul><li><strong>Standard access control</strong> (default on all accounts)</li> <li><strong>Granular access control</strong> (available upon request to all PLUS/ENTERPRISE tier accounts)</li> </ul><h2 data-id="standard-access-control">Standard Access Control</h2> <p><strong>Standard access control</strong> is the default configuration on all JupiterOne accounts. There are two access levels across all resources:</p> <ul><li><p>Users in the <strong>Administrators</strong> group have <strong>full admin access</strong> to all resources</p></li> <li><p>All other users in other groups have <strong>read-only access</strong> to all resources, as well as the permission to <strong>save queries as questions</strong>.</p></li> </ul><p>Standard access control is similar to the <strong>Top Level Permissions</strong> in Granular Access Control.</p> <h2 data-id="granular-access-control">Granular Access Control</h2> <p><strong>Granular access control</strong> is available to all PLUS and ENTERPRISE tier accounts. It allows more fine grain access configuration at each user group level to achieve role-based access control (RBAC).</p> <p>When enabled, to configure access permissions:</p> <ol><li>Go to <strong>Settings</strong> <img src="https://us.v-cdn.net/6035534/uploads/2HC25TNN3732/gear.png" alt="settings" class="embedImage-img importedEmbed-img"></img> and select <strong>Users & Access</strong> <img src="https://us.v-cdn.net/6035534/uploads/IJFWHWYEFGUC/users.png" alt="users" class="embedImage-img importedEmbed-img"></img>.</li> <li>Find the user group you want to edit and click <strong>Settings</strong> <img src="https://us.v-cdn.net/6035534/uploads/2HC25TNN3732/gear.png" alt="settings" class="embedImage-img importedEmbed-img"></img>.</li> <li><p>Click the <strong>Access Control</strong> <img src="https://us.v-cdn.net/6035534/uploads/PDWZBQD6S0CN/shield.png" alt="shield" class="embedImage-img importedEmbed-img"></img> tab.</p> <p><img src="https://us.v-cdn.net/6035534/uploads/SXB4SFAHGW7X/app-permissions.png" alt="app-permissions" class="embedImage-img importedEmbed-img"></img></p></li> </ol><h3 data-id="query-permissions">Query Permissions</h3> <p>Enterprise customers can set query permissions for a user group if you are in the Administrators group. A query permission applies the filter constraints on the data that users in the group are allowed to query. You can configure permission filters by:</p> <ul><li>Entity class</li> <li>Entity type</li> <li>Integration class</li> <li>Integration type</li> <li>Integration configuration instance</li> </ul><p>You can add as many filters as you want to the permission set. To configure query permissions:</p> <ol><li>Go to <strong>Settings</strong> <img src="https://us.v-cdn.net/6035534/uploads/2HC25TNN3732/gear.png" alt="settings" class="embedImage-img importedEmbed-img"></img><strong>></strong> <strong>Users & Access</strong>.</li> <li>Select the user group you want to edit and click <img src="https://us.v-cdn.net/6035534/uploads/PDWZBQD6S0CN/shield.png" alt="shieldicon" class="embedImage-img importedEmbed-img"></img>.</li> <li>In the permission set modal, select and add the type and values for each <br> filter you want in the set.</li> </ol><p>J1 enables queries on data that meet ALL of the filters in the permission set. In this example, J1 enables queries on data that is in GitHub AND in Jira issues AND linked to digital certificate users.</p> <p><img src="https://us.v-cdn.net/6035534/uploads/8BZLZAQO3CPH/user-edit-query-permiss.png" alt="" class="embedImage-img importedEmbed-img"></img></p> <p>If you want to set up queries based on sets of filters that you want to then link by OR logic, create separate permission sets.</p> <h3 data-id="app-permissions">App Permissions</h3> <p>Permissions are configured per group, and any users in a group can perform the actions assigned by the permissions editor. Permissions may take up to five minutes to propagate.</p> <p>Each <strong>app level category</strong> has two permissions: <strong>Read-only</strong> and <strong>Admin</strong>. <strong>Admin</strong> permissions will allow all actions included in the <strong>Read-only</strong> permissions for each app.</p> <p>Each <strong>shared permission</strong> has two permissions: <strong>Read</strong> and <strong>Write</strong>. <strong>Read</strong> permissions will allow access to retrieving the resource, while <strong>Write</strong> will allow mutating / editing of the resource. <strong>Write</strong> permission <strong>does not</strong> implicitly grant <strong>Read</strong> permission in this case, unlike how admin permissions grant read-only permissions implicitly in the case of app level permissions.</p> <h3 data-id="top-level-permissions">Top Level Permissions</h3> <p><strong>Top level permissions</strong> applies to all apps and pages.</p> <ul><li><p>If a group is assigned <strong>top level Admin</strong> access, users in that group will be allowed to perform any action in any app as well as on shared resources.</p></li> <li><p>If a group is assigned <strong>top level Read-only</strong> access, the users in that group will be allowed to access all apps and read all data including on shared resources, however they will not be able to perform actions that require write level permissions (e.g. creating a rule in the Alerts app).</p></li> </ul><h3 data-id="global-shared-permissions">Global Shared Permissions</h3> <p><strong>Shared permissions</strong> are not bound to a specific app, but are relevant to resources that span different apps.</p> <p>List of shared permissions:</p> <ul><li><p><strong>Graph Data</strong> (used anywhere entity and relationship data is retrieved on demand or when entities / relationships are mutated directly; also used for raw data associated with entities)</p></li> <li><p><strong>Questions</strong> (saved J1 queries used in the Landing page Questions Library and in Compliance app for mapping to compliance requirements)</p></li> </ul><p>Some of these permissions are needed for an app to function fully. For example, you are not able to use the Insights app without read permissions for Graph Data because the dashboards and widgets cannot load the data.</p> <h3 data-id="app-level-permissions">App Level Permissions</h3> <p><strong>App level permissions</strong> such as Alerts Read or Alerts Admin apply to the application pages shown primarily on the app switcher. However, a few other categories have been added including Integrations and Endpoint Compliance Agent despite that they are not strictly apps, they function as one and it was easy to group their responsibilities together.</p> <p>Admin permissions for each app allows certain administrative actions unique to each app. For example, add a new standard / questionnaire in Compliance app; save board layout as default in Insights app; etc. Certain actions also require shared permissions to global resources to be enabled.</p> <p>Users not assigned any access at either top level or app level permissions will receive an "Access Denied" error message when attempting to navigate to the app.</p> <p>The full list of the apps is here, along with shared permissions that may be used by features in each app:</p> <p><strong>Note:</strong> <br> You may see a subset of these apps in your settings based on your account subscription level.</p> <ul><li>Landing (the base/root page - <code class="code codeInline" spellcheck="false" tabindex="0">/</code>)</li> </ul><blockquote class="UserQuote blockquote"><div class="QuoteText blockquote-content"> <p class="blockquote-line">Shared permissions used by this app: <strong>Read / Write Questions</strong> and <strong>Read Graph Data</strong> for access to Questions Library and running J1QL queries respectively. Optionally <strong>Write Graph Data</strong> for editing entities from query results.</p> </div></blockquote> <ul><li>Assets Inventory (URL ending with <code class="code codeInline" spellcheck="false" tabindex="0">/inventory</code>)</li> </ul><blockquote class="UserQuote blockquote"><div class="QuoteText blockquote-content"> <p class="blockquote-line">Shared permissions used by this app: <strong>Read / Write Graph Data</strong> (app is unusable without Read Graph Data, Write Graph Data used for editing entities).</p> </div></blockquote> <ul><li>Policies (URL ending with <code class="code codeInline" spellcheck="false" tabindex="0">/policies</code>)</li> </ul><blockquote class="UserQuote blockquote"><div class="QuoteText blockquote-content"> <p class="blockquote-line">Shared permissions used by this app: <strong>Read Graph Data</strong> for loading the policy elements and raw data, and <strong>Write Graph Data</strong> for saving changes to the policy entities.</p> </div></blockquote> <ul><li>Alerts (URL ending with <code class="code codeInline" spellcheck="false" tabindex="0">/alerts</code>)</li> </ul><blockquote class="UserQuote blockquote"><div class="QuoteText blockquote-content"> <p class="blockquote-line">Shared permissions used by this app: <strong>Read Graph Data</strong> (need only for the Vulnerability Findings view, the Alerts view will load results from a historical snapshot and does <em>not</em> need Read Graph Data permission).</p> </div></blockquote> <ul><li>Compliance (URL ending with <code class="code codeInline" spellcheck="false" tabindex="0">/compliance</code>)</li> </ul><blockquote class="UserQuote blockquote"><div class="QuoteText blockquote-content"> <p class="blockquote-line">Shared permissions used by this app: <strong>Read Graph Data</strong> for expanding<br> queries used as evidence to view results, <strong>Read / Write Questions</strong> for<br> editing the questions used in this app.</p> </div></blockquote> <ul><li>Graph Viewer (URL ending with <code class="code codeInline" spellcheck="false" tabindex="0">/galaxy</code>)</li> </ul><blockquote class="UserQuote blockquote"><div class="QuoteText blockquote-content"> <p class="blockquote-line">Shared permissions used by this app: <strong>Read Graph Data</strong>. App will not function without this permission as it is focused on graph exploration.</p> </div></blockquote> <ul><li>Insights (URL ending with <code class="code codeInline" spellcheck="false" tabindex="0">/insights</code>)</li> </ul><blockquote class="UserQuote blockquote"><div class="QuoteText blockquote-content"> <p class="blockquote-line">Shared permissions used by this app: <strong>Read Graph Data</strong>. Dashboards and widgets will not load without this permission.</p> </div></blockquote> <ul><li>Integrations (URL ending with <code class="code codeInline" spellcheck="false" tabindex="0">/integrations</code>)</li> </ul><blockquote class="UserQuote blockquote"><div class="QuoteText blockquote-content"> <p class="blockquote-line">Shared permissions used by this app: none.</p> </div></blockquote> <ul><li>Endpoint Compliance Agent "Power up" (URL ending with <code class="code codeInline" spellcheck="false" tabindex="0">/powerups/endpoint-agent</code>)</li> </ul><blockquote class="UserQuote blockquote"><div class="QuoteText blockquote-content"> <p class="blockquote-line">Shared permissions used by this app: <strong>Read Graph Data</strong>, used to fetch users and devices.</p> </div></blockquote> <h3 data-id="recommended-permissions">Recommended Permissions</h3> <h4 data-id="default-user-group">Default User Group</h4> <p>For the default <em>Users</em> group with the most limited access, set a minimum <strong>Query Permission Set</strong>. The minimum recommended group is <code class="code codeInline" spellcheck="false" tabindex="0">_class</code>:<code class="code codeInline" spellcheck="false" tabindex="0">Root</code>. This permission group only includes the root organization:</p> <p><img src="https://us.v-cdn.net/6035534/uploads/RDO9XMFJ8UT0/j1acct-limited-query-set.png" alt="limited-query-set" class="embedImage-img importedEmbed-img"></img></p> <p>Set the <em>Read-only</em> permission for <strong>Policies</strong> in <strong>App Permissions</strong> to allow users to <em>Review & Accept</em> organizations policies.</p> <h4 data-id="compliance-and-audit-group">Compliance and Audit Group</h4> <p>For a group of users focused on compliance and audit processes, the integrations relevant to the scope of the audit must be included in the query permissions. It is recommended that <strong>App Permissions</strong> for this group include <em>Admin</em> access to <em>Compliance</em> and <em>Policies</em>, as well as <em>Read-only</em> access to <em>Assets</em>.</p> <h4 data-id="integration-service-admin">Integration Service Admin</h4> <p>For a group where configuration of integrated services is necessary, the recommended <strong>App Permissions</strong> for this group include Admin access to <em>Integrations</em>. In cases were <em>Endpoint Compliance</em> is used, <em>Admin</em> access is necessary for this <strong>App Permission</strong> as well. The minimum <strong>Query Permission Set</strong>, <code class="code codeInline" spellcheck="false" tabindex="0">_class</code>:<code class="code codeInline" spellcheck="false" tabindex="0">Root</code>, is recommended for this group, but may be necessary to expand in special cases.</p> <p>It may be necessary to expand access for this group in cases where SAML and SSO configuration must be configured.</p> </article> </main>
.png)