Mapper les autorisations SOAR à IAM

Compatible avec :

Mapper les anciennes autorisations SOAR aux autorisations IAM

Ce document met en correspondance les anciennes autorisations Google Security Operations SOAR avec les autorisations IAM Google Cloud . Utilisez ce mappage pour gérer les accès et les fonctionnalités dans Google SecOps SOAR lors de la migration depuis d'anciens modèles d'autorisation SOAR.

Les sections suivantes listent chaque nom d'autorisation SOAR existant (action) et indiquent les autorisations Cloud IAM requises mappées à cette action.

Important : Accordez toujours la liste complète des autorisations IAM pour un nom d'autorisation SOAR existant (action).

Les listes d'autorisations IAM Google Cloud de ce document correspondent aux ensembles minimaux requis pour que chaque action fonctionne. Pour vous assurer qu'une action fonctionne correctement et que les éléments de la console associés (comme les onglets ou les boutons) s'affichent comme prévu, vous devez accorder toutes les autorisations listées pour cette action.

Autorisations requises pour chaque rôle

Chaque utilisateur de l'environnement doit disposer des autorisations Cloud IAM suivantes pour l'accessibilité de la plate-forme et les fonctionnalités du système. Ces autorisations vous permettent d'afficher l'interface, de gérer les préférences et de générer des jetons d'authentification :

"chronicle.dataAccessScopes.list",
"chronicle.preferenceSets.get",
"chronicle.preferenceSets.update",
"chronicle.instances.get",
"chronicle.socRoles.get",
"chronicle.userNotifications.get",
"chronicle.userLocalizations.get",
"chronicle.moduleSettings.rebranding",
"chronicle.integrations.get",
"chronicle.legacySoarAdvancedReports.get",
"chronicle.environmentGroups.get",
"chronicle.moduleSettingsProperties.get",
"chronicle.legacySoarUsers.get"

Autorisations d'afficher les playbooks

Pour afficher les playbooks, vous devez disposer des autorisations suivantes :

"chronicle.soarNetworks.get",
"chronicle.environments.get",
"chronicle.legacyPlaybooks.get",
"chronicle.legacyPlaybooks.export",
"chronicle.legacySoarSettings.get",
"chronicle.legacySoarDashboards.get",
"chronicle.involvedEntities.get",
"chronicle.caseTagDefinitions.get",
"chronicle.integrationInstances.get",
"chronicle.integrationActions.get",
"chronicle.legacyCaseFederationPlatforms.get",
"chronicle.integrationLogicalOperatorRevisions.get",
"chronicle.integrationLogicalOperators.get"

Autorisations de modifier les playbooks

Pour autoriser la modification des playbooks, vous devez disposer des autorisations suivantes :

"chronicle.soarNetworks.get",
"chronicle.environments.get",
"chronicle.legacyPlaybooks.export",
"chronicle.legacySoarDashboards.get",
"chronicle.involvedEntities.get",
"chronicle.caseTagDefinitions.get",
"chronicle.integrationInstances.get",
"chronicle.integrationActions.get",
"chronicle.legacyCaseFederationPlatforms.get",
"chronicle.emailTemplates.get",
"chronicle.legacyPlaybooks.update",
"chronicle.legacyPlaybooks.delete",
"chronicle.legacyPlaybooks.get",
"chronicle.legacyPlaybooks.import",
"chronicle.legacySoarSettings.get",
"chronicle.legacySoarSettings.update"

Autorisations de gérer les dossiers

Pour autoriser la gestion des dossiers, vous devez disposer des autorisations suivantes :

"chronicle.soarNetworks.get",
"chronicle.environments.get",
"chronicle.legacyPlaybooks.export",
"chronicle.legacySoarDashboards.get",
"chronicle.involvedEntities.get",
"chronicle.caseTagDefinitions.get",
"chronicle.integrationInstances.get",
"chronicle.integrationActions.get",
"chronicle.legacyCaseFederationPlatforms.get",
"chronicle.emailTemplates.get",
"chronicle.legacyPlaybooks.import",
"chronicle.legacySoarSettings.get",
"chronicle.legacySoarSettings.update",
"chronicle.legacyPlaybooks.get",
"chronicle.legacyPlaybooks.update",
"chronicle.legacyPlaybooks.delete"

Autorisations d'afficher les intégrations de réponses

Pour afficher les intégrations de réponse, vous devez disposer des autorisations suivantes :

"chronicle.legacyPlaybooks.get",
"chronicle.legacySoarSettings.get",
"chronicle.marketplaceIntegrations.get",
"chronicle.contentPacks.get",
"chronicle.contentPacks.export",
"chronicle.integrations.get",
"chronicle.integrationInstances.get",
"chronicle.integrationActions.get"

Autorisations permettant de gérer les intégrations, les power-ups et leurs instances

Pour gérer les intégrations, les power-ups et leurs instances, y compris pour les installer, les supprimer, les configurer et les modifier, vous devez disposer des autorisations suivantes :

"chronicle.legacyPlaybooks.get",
"chronicle.legacySoarSettings.get",
"chronicle.marketplaceIntegrations.get",
"chronicle.contentPacks.export",
"chronicle.integrations.get",
"chronicle.integrationActions.get",
"chronicle.contentPacks.get",
"chronicle.contentPacks.delete",
"chronicle.contentPacks.create",
"chronicle.contentPacks.install",
"chronicle.integrationInstances.get",
"chronicle.integrationInstances.update",
"chronicle.integrationInstances.delete"

Autorisations d'afficher les jobs

Pour afficher les jobs, vous devez disposer des autorisations suivantes :

"chronicle.jobInstances.get",
"chronicle.jobInstanceLogs.get",
"chronicle.remoteAgents.get",
"chronicle.jobs.get"

Autorisations de modifier des jobs

Pour autoriser la modification des jobs, vous devez disposer des autorisations suivantes :

"chronicle.jobInstanceLogs.get",
"chronicle.remoteAgents.get",
"chronicle.jobInstances.get",
"chronicle.jobInstances.update",
"chronicle.jobInstances.delete",
"chronicle.jobInstances.run"

Autorisations d'afficher les paramètres

Pour afficher les paramètres, vous devez disposer des autorisations suivantes :

"chronicle.slaDefinitions.get",
"chronicle.requestTemplates.get",
"chronicle.propertySchemaDefinitions.get",
"chronicle.soarNetworks.get",
"chronicle.environments.get",
"chronicle.dynamicParameters.get",
"chronicle.emailTemplates.get",
"chronicle.soarDomains.get",
"chronicle.customLists.get",
"chronicle.caseStageDefinitions.get",
"chronicle.caseCloseDefinitions.get",
"chronicle.alertGroupingRules.get",
"chronicle.legacySystem.getSystemVersion",
"chronicle.legacySystem.getMaximumDataRetentionValue",
"chronicle.legacyConfiguration.getMaximumAlertsGroupingConfiguration",
"chronicle.legacySoarSettings.get",
"chronicle.legacySoarAudits.legacySoarAudit",
"chronicle.formDynamicParameters.get",
"chronicle.customFields.get",
"chronicle.legacySoarIdpMappingGroups.get",
"chronicle.legacySoarUsers.get",
"chronicle.views.get",
"chronicle.moduleSettingsProperties.get",
"chronicle.caseTagDefinitions.get",
"chronicle.entitiesBlocklists.get",
"chronicle.visualFamilies.get",
"chronicle.integrationInstances.get",
"chronicle.legacyCaseFederationPlatforms.get",
"chronicle.remoteAgents.get",
"chronicle.legacyPublisher.get",
"chronicle.calculatedFieldDefinitions.get",
"chronicle.enrichmentAgent.get",
"chronicle.legacySdk.get",
"chronicle.legacySoarPermissionGroups.get",
"chronicle.legacySystemMetadata.get",
"chronicle.legacySystemMetadata.placeholders",
"chronicle.moduleSettings.get",
"chronicle.notificationSettings.get",
"chronicle.systemNotifications.get"

Autorisations de modifier les paramètres

Pour autoriser la modification des paramètres, vous devez disposer des autorisations suivantes :

"chronicle.legacySystem.getSystemVersion",
"chronicle.legacySystem.getMaximumDataRetentionValue",
"chronicle.legacyConfiguration.getMaximumAlertsGroupingConfiguration",
"chronicle.legacySoarAudits.legacySoarAudit",
"chronicle.views.get",
"chronicle.moduleSettingsProperties.get",
"chronicle.visualFamilies.get",
"chronicle.integrationInstances.get",
"chronicle.remoteAgents.get",
"chronicle.legacyPublisher.get",
"chronicle.socRoles.get",
"chronicle.socRoles.update",
"chronicle.socRoles.delete",
"chronicle.slaDefinitions.get",
"chronicle.slaDefinitions.update",
"chronicle.slaDefinitions.delete",
"chronicle.requestTemplates.get",
"chronicle.requestTemplates.update",
"chronicle.requestTemplates.delete",
"chronicle.propertySchemaDefinitions.get",
"chronicle.propertySchemaDefinitions.update",
"chronicle.propertySchemaDefinitions.delete",
"chronicle.soarNetworks.get",
"chronicle.soarNetworks.update",
"chronicle.soarNetworks.delete",
"chronicle.emailTemplates.get",
"chronicle.emailTemplates.update",
"chronicle.emailTemplates.delete",
"chronicle.soarDomains.get",
"chronicle.soarDomains.update",
"chronicle.soarDomains.delete",
"chronicle.customLists.get",
"chronicle.customLists.update",
"chronicle.customLists.delete",
"chronicle.caseStageDefinitions.get",
"chronicle.caseStageDefinitions.update",
"chronicle.caseStageDefinitions.delete",
"chronicle.caseCloseDefinitions.get",
"chronicle.caseCloseDefinitions.update",
"chronicle.caseCloseDefinitions.delete",
"chronicle.alertGroupingRules.get",
"chronicle.alertGroupingRules.update",
"chronicle.alertGroupingRules.delete",
"chronicle.legacySoarSettings.get",
"chronicle.legacySoarSettings.update",
"chronicle.dynamicParameters.get",
"chronicle.formDynamicParameters.get",
"chronicle.formDynamicParameters.update",
"chronicle.customFields.get",
"chronicle.customFields.update",
"chronicle.customFields.delete",
"chronicle.legacySoarUsers.get",
"chronicle.legacySoarUsers.delete",
"chronicle.environments.get",
"chronicle.environments.update",
"chronicle.legacySoarIdpMappingGroups.get",
"chronicle.legacySoarIdpMappingGroups.update",
"chronicle.legacySoarIdpMappingGroups.delete",
"chronicle.caseTagDefinitions.get",
"chronicle.caseTagDefinitions.update",
"chronicle.caseTagDefinitions.delete",
"chronicle.entitiesBlocklists.get",
"chronicle.entitiesBlocklists.update",
"chronicle.entitiesBlocklists.delete",
"chronicle.legacyCaseFederationPlatforms.get",
"chronicle.legacyCaseFederationPlatforms.update",
"chronicle.legacyCaseFederationPlatforms.delete",
"chronicle.calculatedFieldDefinitions.delete",
"chronicle.calculatedFieldDefinitions.update",
"chronicle.legacySdk.update",
"chronicle.moduleSettingsProperties.testSettings",
"chronicle.moduleSettingsProperties.update",
"chronicle.notificationSettings.update",
"chronicle.systemNotifications.update",
"chronicle.userLocalizations.update",
"chronicle.userNotifications.update"

Autorisations de modifier les environnements

Pour autoriser la modification des environnements, vous devez disposer des autorisations suivantes :

"chronicle.slaDefinitions.get",
"chronicle.requestTemplates.get",
"chronicle.propertySchemaDefinitions.get",
"chronicle.soarNetworks.get",
"chronicle.emailTemplates.get",
"chronicle.soarDomains.get",
"chronicle.customLists.get",
"chronicle.caseStageDefinitions.get",
"chronicle.caseCloseDefinitions.get",
"chronicle.alertGroupingRules.get",
"chronicle.legacySystem.getSystemVersion",
"chronicle.legacySystem.getMaximumDataRetentionValue",
"chronicle.legacyConfiguration.getMaximumAlertsGroupingConfiguration",
"chronicle.legacySoarSettings.get",
"chronicle.legacySoarAudits.legacySoarAudit",
"chronicle.dynamicParameters.get",
"chronicle.formDynamicParameters.get",
"chronicle.customFields.get",
"chronicle.legacySoarIdpMappingGroups.get",
"chronicle.legacySoarUsers.get",
"chronicle.views.get",
"chronicle.moduleSettingsProperties.get",
"chronicle.caseTagDefinitions.get",
"chronicle.entitiesBlocklists.get",
"chronicle.visualFamilies.get",
"chronicle.integrationInstances.get",
"chronicle.legacyCaseFederationPlatforms.get",
"chronicle.remoteAgents.get",
"chronicle.legacyPublisher.get",
"chronicle.environments.get",
"chronicle.environments.update",
"chronicle.environments.delete",
"chronicle.environmentGroups.get",
"chronicle.environmentGroups.update",
"chronicle.environmentGroups.delete"

Autorisations d'afficher les agents distants

Pour afficher les agents distants, vous devez disposer des autorisations suivantes :

"chronicle.remoteAgents.get",
"chronicle.legacyPublisher.get"

Autorisations de modifier les agents

Pour autoriser la modification des agents, vous devez disposer des autorisations suivantes :

"chronicle.remoteAgents.get",
"chronicle.remoteAgents.update",
"chronicle.remoteAgents.delete",
"chronicle.legacyPublisher.get",
"chronicle.legacyPublisher.update"

Autorisations pour les vues

Pour gérer les vues, vous devez disposer des autorisations suivantes :

"chronicle.views.get",
"chronicle.views.update"

Autorisations d'afficher les connecteurs

Pour afficher les connecteurs, vous devez disposer des autorisations suivantes :

"chronicle.connectorInstances.get",
"chronicle.connectorInstanceLogs.get",
"chronicle.remoteAgents.get"

Autorisations de modifier les connecteurs

Pour autoriser la modification des connecteurs, vous devez disposer des autorisations suivantes :

"chronicle.connectorInstanceLogs.get",
"chronicle.remoteAgents.get",
"chronicle.legacyCases.get",
"chronicle.legacyCases.ingest",
"chronicle.connectorInstances.update",
"chronicle.connectorInstances.delete",
"chronicle.connectorInstances.get"

Autorisations d'afficher les webhooks

Pour afficher les webhooks, vous devez disposer des autorisations suivantes :

"chronicle.webhooks.get"

Autorisations de modifier les webhooks

Pour autoriser la modification des webhooks, vous devez disposer des autorisations suivantes :

"chronicle.webhooks.get",
"chronicle.webhooks.update",
"chronicle.webhooks.delete"

Autorisations pour afficher les tableaux de bord

Pour afficher les tableaux de bord, vous devez disposer des autorisations suivantes :

"chronicle.environments.get",
"chronicle.legacyPlaybooks.get",
"chronicle.legacySearches.searchCases",
"chronicle.legacySearches.searchEntities",
"chronicle.legacySoarSettings.get",
"chronicle.legacySoarDashboards.update",
"chronicle.legacySoarDashboards.get",
"chronicle.legacySoarUsers.get",
"chronicle.integrationInstances.get",
"chronicle.integrationActions.get",
"chronicle.legacyCaseFederationPlatforms.get"

Autorisations de modifier les tableaux de bord

Pour autoriser la modification des tableaux de bord, vous devez disposer des autorisations suivantes :

"chronicle.environments.get",
"chronicle.legacyPlaybooks.get",
"chronicle.legacySearches.searchCases",
"chronicle.legacySearches.searchEntities",
"chronicle.legacySoarSettings.get",
"chronicle.legacySoarUsers.get",
"chronicle.integrationInstances.get",
"chronicle.integrationActions.get",
"chronicle.legacyCaseFederationPlatforms.get",
"chronicle.legacySoarDashboards.update",
"chronicle.legacySoarDashboards.get",
"chronicle.legacySoarDashboards.delete"

Pour afficher la recherche SOAR, vous devez disposer des autorisations suivantes :

"chronicle.caseStageDefinitions.get",
"chronicle.legacySearches.searchEntities",
"chronicle.legacySearches.searchCases",
"chronicle.caseTagDefinitions.get"

Pour afficher la recherche de demandes, vous devez disposer des autorisations suivantes :

"chronicle.caseTagDefinitions.get",
"chronicle.caseStageDefinitions.get",
"chronicle.legacySearches.searchCases",
"chronicle.legacySearches.searchEntities"

Autorisations permettant d'effectuer des actions de recherche

Pour autoriser les actions de recherche, vous devez disposer des autorisations suivantes :

"chronicle.caseTagDefinitions.get",
"chronicle.caseStageDefinitions.get",
"chronicle.legacySearches.searchCases",
"chronicle.legacySearches.searchEntities",
"chronicle.cases.get",
"chronicle.cases.close",
"chronicle.cases.reopen",
"chronicle.cases.update"

Autorisations d'afficher les demandes d'assistance

Pour afficher les demandes, vous devez disposer des autorisations suivantes :

"chronicle.propertySchemaDefinitions.get",
"chronicle.environments.get",
"chronicle.emailTemplates.get",
"chronicle.caseStageDefinitions.get",
"chronicle.caseCloseDefinitions.get",
"chronicle.legacyPlaybooks.get",
"chronicle.legacyPlaybooks.export",
"chronicle.legacySoarSettings.get",
"chronicle.formDynamicParameters.get",
"chronicle.customFieldValues.get",
"chronicle.customFields.get",
"chronicle.contextProperties.get",
"chronicle.legacySoarUsers.get",
"chronicle.connectorEvents.get",
"chronicle.involvedEntities.get",
"chronicle.cases.get",
"chronicle.caseAlerts.get",
"chronicle.tasks.get",
"chronicle.views.get",
"chronicle.caseTagDefinitions.get",
"chronicle.integrationInstances.get",
"chronicle.legacyCaseFederationPlatforms.get",
"chronicle.legacyFederatedCases.get",
"chronicle.caseQueueFilters.update",
"chronicle.caseQueueFilters.get",
"chronicle.caseQueueFilters.delete",
"chronicle.cases.countPriorities",
"chronicle.cases.generateReport",
"chronicle.legacyFederatedCases.fetchCasesToSync",
"chronicle.legacySystemMetadata.placeholders"

Autorisations d'afficher les demandes 2.0

Pour afficher les demandes 2.0, vous devez disposer des autorisations suivantes :

"chronicle.propertySchemaDefinitions.get",
"chronicle.environments.get",
"chronicle.emailTemplates.get",
"chronicle.caseStageDefinitions.get",
"chronicle.caseCloseDefinitions.get",
"chronicle.legacyPlaybooks.get",
"chronicle.legacyPlaybooks.export",
"chronicle.legacySoarSettings.get",
"chronicle.formDynamicParameters.get",
"chronicle.customFieldValues.get",
"chronicle.customFields.get",
"chronicle.contextProperties.get",
"chronicle.legacySoarUsers.get",
"chronicle.connectorEvents.get",
"chronicle.involvedEntities.get",
"chronicle.cases.get",
"chronicle.caseAlerts.get",
"chronicle.tasks.get",
"chronicle.caseTagDefinitions.get",
"chronicle.integrationInstances.get",
"chronicle.legacyCaseFederationPlatforms.get",
"chronicle.legacyFederatedCases.get",
"chronicle.caseQueueFilters.update",
"chronicle.caseQueueFilters.get",
"chronicle.caseQueueFilters.delete",
"chronicle.caseDetections.get",
"chronicle.caseEvents.get",
"chronicle.views.get",
"chronicle.caseEvidenceDatas.get",
"chronicle.cases.countPriorities",
"chronicle.cases.generateReport",
"chronicle.enrichmentAgent.get",
"chronicle.legacyFederatedCases.fetchCasesToSync",
"chronicle.legacySystemMetadata.placeholders"

Autorisations permettant d'effectuer des actions de gestion des demandes d'assistance

Pour autoriser les actions de gestion des demandes, vous devez disposer des autorisations suivantes :

"chronicle.environments.get",
"chronicle.emailTemplates.get",
"chronicle.caseStageDefinitions.get",
"chronicle.caseCloseDefinitions.get",
"chronicle.legacyPlaybooks.get",
"chronicle.legacyPlaybooks.export",
"chronicle.legacySoarSettings.get",
"chronicle.formDynamicParameters.get",
"chronicle.customFields.get",
"chronicle.legacySoarUsers.get",
"chronicle.connectorEvents.get",
"chronicle.tasks.get",
"chronicle.views.get",
"chronicle.caseTagDefinitions.get",
"chronicle.integrationInstances.get",
"chronicle.legacyCaseFederationPlatforms.get",
"chronicle.legacyFederatedCases.get",
"chronicle.caseQueueFilters.update",
"chronicle.caseQueueFilters.get",
"chronicle.caseQueueFilters.delete",
"chronicle.propertySchemaDefinitions.get",
"chronicle.propertySchemaDefinitions.update",
"chronicle.propertySchemaDefinitions.delete",
"chronicle.legacyCases.get",
"chronicle.legacyCases.ingest",
"chronicle.customFieldValues.get",
"chronicle.customFieldValues.update",
"chronicle.contextProperties.get",
"chronicle.contextProperties.update",
"chronicle.contextProperties.delete",
"chronicle.involvedEntities.get",
"chronicle.involvedEntities.update",
"chronicle.cases.get",
"chronicle.cases.update",
"chronicle.cases.updateTag",
"chronicle.cases.removeTag",
"chronicle.cases.close",
"chronicle.cases.reopen",
"chronicle.caseAlerts.get",
"chronicle.caseAlerts.metadataUpdate",
"chronicle.caseAlerts.move",
"chronicle.caseAlerts.removeTag",
"chronicle.caseAlerts.updateTag",
"chronicle.enrichmentAgent.execute",
"chronicle.legacyFederatedCases.batchPatchFederatedCases",
"chronicle.legacySystemMetadata.placeholders"

Autorisations d'afficher l'onglet des playbooks de demande d'assistance

Pour afficher l'onglet des playbooks de demande, vous devez disposer des autorisations suivantes :

"chronicle.propertySchemaDefinitions.get",
"chronicle.environments.get",
"chronicle.emailTemplates.get",
"chronicle.caseStageDefinitions.get",
"chronicle.caseCloseDefinitions.get",
"chronicle.legacyPlaybooks.export",
"chronicle.legacySoarSettings.get",
"chronicle.formDynamicParameters.get",
"chronicle.customFieldValues.get",
"chronicle.customFields.get",
"chronicle.contextProperties.get",
"chronicle.legacySoarUsers.get",
"chronicle.connectorEvents.get",
"chronicle.involvedEntities.get",
"chronicle.cases.get",
"chronicle.caseAlerts.get",
"chronicle.tasks.get",
"chronicle.views.get",
"chronicle.caseTagDefinitions.get",
"chronicle.integrationInstances.get",
"chronicle.legacyCaseFederationPlatforms.get",
"chronicle.legacyFederatedCases.get",
"chronicle.caseQueueFilters.update",
"chronicle.caseQueueFilters.get",
"chronicle.caseQueueFilters.delete",
"chronicle.legacyPlaybooks.get"

Autorisations d'associer des playbooks manuellement

Pour autoriser l'association manuelle de playbooks, vous devez disposer des autorisations suivantes :

"chronicle.propertySchemaDefinitions.get",
"chronicle.environments.get",
"chronicle.emailTemplates.get",
"chronicle.caseStageDefinitions.get",
"chronicle.caseCloseDefinitions.get",
"chronicle.legacyPlaybooks.export",
"chronicle.legacySoarSettings.get",
"chronicle.formDynamicParameters.get",
"chronicle.customFieldValues.get",
"chronicle.customFields.get",
"chronicle.contextProperties.get",
"chronicle.legacySoarUsers.get",
"chronicle.connectorEvents.get",
"chronicle.involvedEntities.get",
"chronicle.cases.get",
"chronicle.caseAlerts.get",
"chronicle.tasks.get",
"chronicle.views.get",
"chronicle.caseTagDefinitions.get",
"chronicle.integrationInstances.get",
"chronicle.legacyCaseFederationPlatforms.get",
"chronicle.legacyFederatedCases.get",
"chronicle.caseQueueFilters.update",
"chronicle.caseQueueFilters.get",
"chronicle.caseQueueFilters.delete",
"chronicle.legacyPlaybooks.update",
"chronicle.legacyPlaybooks.get"

Autorisations pour répondre aux actions

Pour autoriser la réponse aux actions, vous devez disposer des autorisations suivantes :

"chronicle.propertySchemaDefinitions.get",
"chronicle.environments.get",
"chronicle.emailTemplates.get",
"chronicle.caseStageDefinitions.get",
"chronicle.caseCloseDefinitions.get",
"chronicle.legacyPlaybooks.export",
"chronicle.legacySoarSettings.get",
"chronicle.formDynamicParameters.get",
"chronicle.customFieldValues.get",
"chronicle.customFields.get",
"chronicle.contextProperties.get",
"chronicle.legacySoarUsers.get",
"chronicle.connectorEvents.get",
"chronicle.involvedEntities.get",
"chronicle.cases.get",
"chronicle.caseAlerts.get",
"chronicle.tasks.get",
"chronicle.views.get",
"chronicle.caseTagDefinitions.get",
"chronicle.integrationInstances.get",
"chronicle.legacyCaseFederationPlatforms.get",
"chronicle.legacyFederatedCases.get",
"chronicle.caseQueueFilters.update",
"chronicle.caseQueueFilters.get",
"chronicle.caseQueueFilters.delete",
"chronicle.legacyPlaybooks.get",
"chronicle.legacyPlaybooks.update"

Autorisations de réexécuter les playbooks associés

Pour autoriser la réexécution des playbooks associés, vous devez disposer des autorisations suivantes :

"chronicle.propertySchemaDefinitions.get",
"chronicle.environments.get",
"chronicle.emailTemplates.get",
"chronicle.caseStageDefinitions.get",
"chronicle.caseCloseDefinitions.get",
"chronicle.legacyPlaybooks.export",
"chronicle.legacySoarSettings.get",
"chronicle.formDynamicParameters.get",
"chronicle.customFieldValues.get",
"chronicle.customFields.get",
"chronicle.contextProperties.get",
"chronicle.legacySoarUsers.get",
"chronicle.connectorEvents.get",
"chronicle.involvedEntities.get",
"chronicle.cases.get",
"chronicle.caseAlerts.get",
"chronicle.tasks.get",
"chronicle.views.get",
"chronicle.caseTagDefinitions.get",
"chronicle.integrationInstances.get",
"chronicle.legacyCaseFederationPlatforms.get",
"chronicle.legacyFederatedCases.get",
"chronicle.caseQueueFilters.update",
"chronicle.caseQueueFilters.get",
"chronicle.caseQueueFilters.delete",
"chronicle.legacyPlaybooks.get",
"chronicle.legacyPlaybooks.update"

Autorisations pour afficher l'onglet "Mur des cas"

Pour afficher l'onglet "Mur de la demande", vous devez disposer des autorisations suivantes :

"chronicle.propertySchemaDefinitions.get",
"chronicle.environments.get",
"chronicle.emailTemplates.get",
"chronicle.caseStageDefinitions.get",
"chronicle.caseCloseDefinitions.get",
"chronicle.legacyPlaybooks.get",
"chronicle.legacyPlaybooks.export",
"chronicle.legacySoarSettings.get",
"chronicle.formDynamicParameters.get",
"chronicle.customFieldValues.get",
"chronicle.customFields.get",
"chronicle.contextProperties.get",
"chronicle.legacySoarUsers.get",
"chronicle.connectorEvents.get",
"chronicle.involvedEntities.get",
"chronicle.cases.get",
"chronicle.caseAlerts.get",
"chronicle.tasks.get",
"chronicle.views.get",
"chronicle.caseTagDefinitions.get",
"chronicle.integrationInstances.get",
"chronicle.legacyCaseFederationPlatforms.get",
"chronicle.legacyFederatedCases.get",
"chronicle.caseQueueFilters.update",
"chronicle.caseQueueFilters.get",
"chronicle.caseQueueFilters.delete",
"chronicle.legacyCases.get",
"chronicle.caseComments.get",
"chronicle.caseWallRecords.get",
"chronicle.caseWallRecords.update"

Autorisations d'ajouter et de modifier des commentaires et des pièces jointes

Pour autoriser l'ajout et la modification de commentaires et de pièces jointes, vous devez disposer des autorisations suivantes :

"chronicle.propertySchemaDefinitions.get",
"chronicle.environments.get",
"chronicle.emailTemplates.get",
"chronicle.caseStageDefinitions.get",
"chronicle.caseCloseDefinitions.get",
"chronicle.legacyPlaybooks.get",
"chronicle.legacyPlaybooks.export",
"chronicle.legacySoarSettings.get",
"chronicle.formDynamicParameters.get",
"chronicle.customFieldValues.get",
"chronicle.customFields.get",
"chronicle.contextProperties.get",
"chronicle.legacySoarUsers.get",
"chronicle.connectorEvents.get",
"chronicle.involvedEntities.get",
"chronicle.cases.get",
"chronicle.caseAlerts.get",
"chronicle.tasks.get",
"chronicle.views.get",
"chronicle.caseTagDefinitions.get",
"chronicle.integrationInstances.get",
"chronicle.legacyCaseFederationPlatforms.get",
"chronicle.legacyFederatedCases.get",
"chronicle.caseQueueFilters.update",
"chronicle.caseQueueFilters.get",
"chronicle.caseQueueFilters.delete",
"chronicle.legacyCases.get",
"chronicle.caseWallRecords.get",
"chronicle.caseWallRecords.update",
"chronicle.caseComments.get",
"chronicle.caseComments.update",
"chronicle.caseComments.delete"

Autorisations d'épingler des messages de chat de cas au mur des cas

Pour autoriser l'épinglage des messages de chat d'une demande sur le mur de la demande, vous devez disposer des autorisations suivantes :

"chronicle.propertySchemaDefinitions.get",
"chronicle.environments.get",
"chronicle.emailTemplates.get",
"chronicle.caseStageDefinitions.get",
"chronicle.caseCloseDefinitions.get",
"chronicle.legacyPlaybooks.get",
"chronicle.legacyPlaybooks.export",
"chronicle.legacySoarSettings.get",
"chronicle.formDynamicParameters.get",
"chronicle.customFieldValues.get",
"chronicle.customFields.get",
"chronicle.contextProperties.get",
"chronicle.legacySoarUsers.get",
"chronicle.connectorEvents.get",
"chronicle.involvedEntities.get",
"chronicle.cases.get",
"chronicle.caseAlerts.get",
"chronicle.tasks.get",
"chronicle.views.get",
"chronicle.caseTagDefinitions.get",
"chronicle.integrationInstances.get",
"chronicle.legacyCaseFederationPlatforms.get",
"chronicle.legacyFederatedCases.get",
"chronicle.caseQueueFilters.update",
"chronicle.caseQueueFilters.get",
"chronicle.caseQueueFilters.delete",
"chronicle.legacyCases.get",
"chronicle.caseComments.get",
"chronicle.caseWallRecords.get",
"chronicle.caseWallRecords.update",
"chronicle.chatMessages.pin",
"chronicle.chatMessages.get"

Autorisations permettant de simuler des cas d'utilisation

Pour autoriser la simulation de cas, vous devez disposer des autorisations suivantes :

"chronicle.propertySchemaDefinitions.get",
"chronicle.environments.get",
"chronicle.emailTemplates.get",
"chronicle.caseStageDefinitions.get",
"chronicle.caseCloseDefinitions.get",
"chronicle.legacyPlaybooks.get",
"chronicle.legacyPlaybooks.export",
"chronicle.legacySoarSettings.get",
"chronicle.formDynamicParameters.get",
"chronicle.customFieldValues.get",
"chronicle.customFields.get",
"chronicle.contextProperties.get",
"chronicle.legacySoarUsers.get",
"chronicle.connectorEvents.get",
"chronicle.involvedEntities.get",
"chronicle.cases.get",
"chronicle.caseAlerts.get",
"chronicle.tasks.get",
"chronicle.views.get",
"chronicle.caseTagDefinitions.get",
"chronicle.integrationInstances.get",
"chronicle.legacyCaseFederationPlatforms.get",
"chronicle.legacyFederatedCases.get",
"chronicle.caseQueueFilters.update",
"chronicle.caseQueueFilters.get",
"chronicle.caseQueueFilters.delete",
"chronicle.legacyCases.importJson",
"chronicle.legacyCases.deleteSimulated",
"chronicle.legacyCases.simulate",
"chronicle.legacyCases.get",
"chronicle.legacyCases.exportJson",
"chronicle.legacyCases.createSimulated",
"chronicle.legacyCases.getSimulated"

Autorisations d'ingérer des alertes en tant que scénarios de test

Pour autoriser l'ingestion d'alertes en tant que scénarios de test, vous devez disposer des autorisations suivantes :

"chronicle.propertySchemaDefinitions.get",
"chronicle.environments.get",
"chronicle.emailTemplates.get",
"chronicle.caseStageDefinitions.get",
"chronicle.caseCloseDefinitions.get",
"chronicle.legacyPlaybooks.get",
"chronicle.legacyPlaybooks.export",
"chronicle.legacySoarSettings.get",
"chronicle.formDynamicParameters.get",
"chronicle.customFieldValues.get",
"chronicle.customFields.get",
"chronicle.contextProperties.get",
"chronicle.legacySoarUsers.get",
"chronicle.connectorEvents.get",
"chronicle.involvedEntities.get",
"chronicle.cases.get",
"chronicle.caseAlerts.get",
"chronicle.tasks.get",
"chronicle.views.get",
"chronicle.caseTagDefinitions.get",
"chronicle.integrationInstances.get",
"chronicle.legacyCaseFederationPlatforms.get",
"chronicle.legacyFederatedCases.get",
"chronicle.caseQueueFilters.update",
"chronicle.caseQueueFilters.get",
"chronicle.caseQueueFilters.delete",
"chronicle.legacyCases.get",
"chronicle.legacyCases.ingestAlertTestCase"

Autorisations pour effectuer des actions manuelles

Pour autoriser l'exécution d'actions manuelles, vous devez disposer des autorisations suivantes :

"chronicle.propertySchemaDefinitions.get",
"chronicle.environments.get",
"chronicle.emailTemplates.get",
"chronicle.caseStageDefinitions.get",
"chronicle.caseCloseDefinitions.get",
"chronicle.legacyPlaybooks.get",
"chronicle.legacyPlaybooks.export",
"chronicle.legacySoarSettings.get",
"chronicle.formDynamicParameters.get",
"chronicle.customFieldValues.get",
"chronicle.customFields.get",
"chronicle.contextProperties.get",
"chronicle.legacySoarUsers.get",
"chronicle.connectorEvents.get",
"chronicle.involvedEntities.get",
"chronicle.cases.get",
"chronicle.caseAlerts.get",
"chronicle.tasks.get",
"chronicle.views.get",
"chronicle.caseTagDefinitions.get",
"chronicle.integrationInstances.get",
"chronicle.legacyCaseFederationPlatforms.get",
"chronicle.legacyFederatedCases.get",
"chronicle.caseQueueFilters.update",
"chronicle.caseQueueFilters.get",
"chronicle.caseQueueFilters.delete",
"chronicle.legacyCases.get",
"chronicle.legacyCases.runManualAction"

Autorisations de créer des demandes manuelles

Pour autoriser la création manuelle de demandes, vous devez disposer des autorisations suivantes :

"chronicle.propertySchemaDefinitions.get",
"chronicle.environments.get",
"chronicle.emailTemplates.get",
"chronicle.caseStageDefinitions.get",
"chronicle.caseCloseDefinitions.get",
"chronicle.legacyPlaybooks.export",
"chronicle.legacySoarSettings.get",
"chronicle.formDynamicParameters.get",
"chronicle.customFieldValues.get",
"chronicle.customFields.get",
"chronicle.contextProperties.get",
"chronicle.legacySoarUsers.get",
"chronicle.connectorEvents.get",
"chronicle.involvedEntities.get",
"chronicle.cases.get",
"chronicle.caseAlerts.get",
"chronicle.tasks.get",
"chronicle.views.get",
"chronicle.caseTagDefinitions.get",
"chronicle.integrationInstances.get",
"chronicle.legacyCaseFederationPlatforms.get",
"chronicle.legacyFederatedCases.get",
"chronicle.caseQueueFilters.update",
"chronicle.caseQueueFilters.get",
"chronicle.caseQueueFilters.delete",
"chronicle.legacyCases.get",
"chronicle.legacyCases.createManual",
"chronicle.legacyPlaybooks.get"

Autorisations pour répondre aux actions

Pour autoriser la réponse aux actions, vous devez disposer des autorisations suivantes :

"chronicle.propertySchemaDefinitions.get",
"chronicle.environments.get",
"chronicle.emailTemplates.get",
"chronicle.caseStageDefinitions.get",
"chronicle.caseCloseDefinitions.get",
"chronicle.legacyPlaybooks.export",
"chronicle.legacySoarSettings.get",
"chronicle.formDynamicParameters.get",
"chronicle.customFieldValues.get",
"chronicle.customFields.get",
"chronicle.contextProperties.get",
"chronicle.legacySoarUsers.get",
"chronicle.connectorEvents.get",
"chronicle.involvedEntities.get",
"chronicle.cases.get",
"chronicle.caseAlerts.get",
"chronicle.tasks.get",
"chronicle.views.get",
"chronicle.caseTagDefinitions.get",
"chronicle.integrationInstances.get",
"chronicle.legacyCaseFederationPlatforms.get",
"chronicle.legacyFederatedCases.get",
"chronicle.caseQueueFilters.update",
"chronicle.caseQueueFilters.get",
"chronicle.caseQueueFilters.delete",
"chronicle.legacyPlaybooks.get",
"chronicle.legacyPlaybooks.update"

Autorisations pour autoriser le chat sur les demandes d'assistance

Pour autoriser le chat sur les demandes, vous devez disposer des autorisations suivantes :

"chronicle.propertySchemaDefinitions.get",
"chronicle.environments.get",
"chronicle.emailTemplates.get",
"chronicle.caseStageDefinitions.get",
"chronicle.caseCloseDefinitions.get",
"chronicle.legacyPlaybooks.get",
"chronicle.legacyPlaybooks.export",
"chronicle.legacySoarSettings.get",
"chronicle.formDynamicParameters.get",
"chronicle.customFieldValues.get",
"chronicle.customFields.get",
"chronicle.contextProperties.get",
"chronicle.legacySoarUsers.get",
"chronicle.connectorEvents.get",
"chronicle.involvedEntities.get",
"chronicle.cases.get",
"chronicle.caseAlerts.get",
"chronicle.tasks.get",
"chronicle.views.get",
"chronicle.caseTagDefinitions.get",
"chronicle.integrationInstances.get",
"chronicle.legacyCaseFederationPlatforms.get",
"chronicle.legacyFederatedCases.get",
"chronicle.caseQueueFilters.update",
"chronicle.caseQueueFilters.get",
"chronicle.caseQueueFilters.delete",
"chronicle.chatMessages.get",
"chronicle.chatMessages.create",
"chronicle.chatMessageAttachments.get",
"chronicle.instances.generateSoarChatMessage"

Autorisations d'ajout et de modification des propriétés d'entité

Pour autoriser l'ajout et la modification de propriétés d'entité, vous devez disposer des autorisations suivantes :

"chronicle.propertySchemaDefinitions.get",
"chronicle.environments.get",
"chronicle.emailTemplates.get",
"chronicle.caseStageDefinitions.get",
"chronicle.caseCloseDefinitions.get",
"chronicle.legacyPlaybooks.get",
"chronicle.legacyPlaybooks.export",
"chronicle.legacySoarSettings.get",
"chronicle.formDynamicParameters.get",
"chronicle.customFieldValues.get",
"chronicle.customFields.get",
"chronicle.contextProperties.get",
"chronicle.legacySoarUsers.get",
"chronicle.connectorEvents.get",
"chronicle.cases.get",
"chronicle.caseAlerts.get",
"chronicle.tasks.get",
"chronicle.views.get",
"chronicle.caseTagDefinitions.get",
"chronicle.integrationInstances.get",
"chronicle.legacyCaseFederationPlatforms.get",
"chronicle.legacyFederatedCases.get",
"chronicle.caseQueueFilters.update",
"chronicle.caseQueueFilters.get",
"chronicle.caseQueueFilters.delete",
"chronicle.involvedEntities.get",
"chronicle.involvedEntities.update"

Autorisations de partager les filtres de la file d'attente des demandes d'assistance

Pour autoriser le partage des filtres de la file d'attente des demandes, vous devez disposer des autorisations suivantes :

"chronicle.propertySchemaDefinitions.get",
"chronicle.environments.get",
"chronicle.emailTemplates.get",
"chronicle.caseStageDefinitions.get",
"chronicle.caseCloseDefinitions.get",
"chronicle.legacyPlaybooks.get",
"chronicle.legacyPlaybooks.export",
"chronicle.legacySoarSettings.get",
"chronicle.formDynamicParameters.get",
"chronicle.customFieldValues.get",
"chronicle.customFields.get",
"chronicle.contextProperties.get",
"chronicle.legacySoarUsers.get",
"chronicle.connectorEvents.get",
"chronicle.involvedEntities.get",
"chronicle.cases.get",
"chronicle.caseAlerts.get",
"chronicle.tasks.get",
"chronicle.views.get",
"chronicle.caseTagDefinitions.get",
"chronicle.integrationInstances.get",
"chronicle.legacyCaseFederationPlatforms.get",
"chronicle.legacyFederatedCases.get",
"chronicle.caseQueueFilters.update",
"chronicle.caseQueueFilters.get",
"chronicle.caseQueueFilters.delete",
"chronicle.shareConfigs.update"

Autorisations pour l'explorateur d'entités

Pour afficher l'explorateur d'entités, vous devez disposer des autorisations suivantes :

"chronicle.propertySchemaDefinitions.get",
"chronicle.uniqueEntities.get"

Autorisations d'ajout de commentaires

Pour autoriser l'ajout de commentaires dans l'explorateur d'entités, vous devez disposer des autorisations suivantes :

"chronicle.propertySchemaDefinitions.get",
"chronicle.uniqueEntities.get",
"chronicle.uniqueEntities.update"

Autorisations d'ajouter et de modifier des propriétés d'entité dans l'explorateur d'entités

Pour autoriser l'ajout et la modification de propriétés d'entité dans l'explorateur d'entités, vous devez disposer des autorisations suivantes :

"chronicle.propertySchemaDefinitions.get",
"chronicle.uniqueEntities.get",
"chronicle.uniqueEntities.update"

Autorisations pour Your Workdesk

Pour afficher Votre bureau, vous devez disposer des autorisations suivantes :

"chronicle.requestTemplates.get",
"chronicle.legacySearches.searchCases",
"chronicle.legacySearches.searchEntities",
"chronicle.legacySoarUsers.get"

Autorisations pour Mes tâches

Pour afficher "Mes tâches" sur votre bureau, vous devez disposer des autorisations suivantes :

"chronicle.requestTemplates.get",
"chronicle.legacySearches.searchCases",
"chronicle.legacySearches.searchEntities",
"chronicle.legacySoarUsers.get",
"chronicle.tasks.get"

Autorisations de créer et de modifier des tâches

Pour autoriser la création et la modification de tâches, vous devez disposer des autorisations suivantes :

"chronicle.requestTemplates.get",
"chronicle.legacySearches.searchCases",
"chronicle.legacySearches.searchEntities",
"chronicle.legacySoarUsers.get",
"chronicle.tasks.get",
"chronicle.tasks.update",
"chronicle.tasks.delete"

Autorisations pour les annonces

Pour afficher les annonces sur votre bureau, vous devez disposer des autorisations suivantes :

"chronicle.requestTemplates.get",
"chronicle.legacySearches.searchCases",
"chronicle.legacySearches.searchEntities",
"chronicle.legacySoarUsers.get",
"chronicle.announcements.get"

Autorisations de créer et de modifier des annonces

Pour autoriser la création et la modification d'annonces, vous devez disposer des autorisations suivantes :

"chronicle.requestTemplates.get",
"chronicle.legacySearches.searchCases",
"chronicle.legacySearches.searchEntities",
"chronicle.legacySoarUsers.get",
"chronicle.announcements.get",
"chronicle.announcements.update",
"chronicle.announcements.delete"

Autorisations pour les requêtes

Pour afficher les demandes sur votre bureau, vous devez disposer des autorisations suivantes :

"chronicle.legacySearches.searchCases",
"chronicle.legacySearches.searchEntities",
"chronicle.legacySoarUsers.get",
"chronicle.requestTemplates.get"

Autorisations pour les actions en attente

Pour afficher les actions en attente sur Votre bureau, vous devez disposer des autorisations suivantes :

"chronicle.requestTemplates.get",
"chronicle.legacySearches.searchCases",
"chronicle.legacySearches.searchEntities",
"chronicle.legacySoarUsers.get",
"chronicle.legacyPlaybooks.get",
"chronicle.legacyPlaybooks.update"

Autorisations pour Workspace

Pour utiliser la fonctionnalité d'espace de travail sur Your Workdesk, vous devez disposer des autorisations suivantes :

"chronicle.requestTemplates.get",
"chronicle.legacySearches.searchCases",
"chronicle.legacySearches.searchEntities",
"chronicle.legacySoarUsers.get",
"chronicle.workdeskNotes.update",
"chronicle.workdeskNotes.get",
"chronicle.workdeskNotes.delete",
"chronicle.workdeskLinks.update",
"chronicle.workdeskLinks.get",
"chronicle.workdeskLinks.delete",
"chronicle.workdeskContacts.update",
"chronicle.workdeskContacts.get",
"chronicle.workdeskContacts.delete",
"chronicle.attachments.update",
"chronicle.attachments.get",
"chronicle.attachments.delete"

Autorisations pour l'outil d'investigation

Cette section traite des autorisations liées aux tâches d'investigation.

Autorisations d'effectuer des actions manuelles

Pour autoriser l'exécution d'actions manuelles lors d'une investigation, vous devez disposer des autorisations suivantes :

"chronicle.legacyCases.get",
"chronicle.legacyCases.runManualAction"

Autorisations d'ajouter et de modifier des propriétés d'entité dans l'investigation

Pour autoriser l'ajout et la modification des propriétés d'une entité lors d'une investigation, vous devez disposer des autorisations suivantes :

"chronicle.involvedEntities.get",
"chronicle.involvedEntities.update"

Autorisations pour les rapports

Pour afficher les rapports, vous devez disposer des autorisations suivantes :

"chronicle.environments.get",
"chronicle.legacyPlaybooks.get",
"chronicle.legacySoarSettings.get",
"chronicle.legacySoarReports.get",
"chronicle.integrationInstances.get",
"chronicle.integrationActions.get",
"chronicle.legacyCaseFederationPlatforms.get"

Autorisations de modifier les rapports

Pour autoriser la modification des rapports, vous devez disposer des autorisations suivantes :

"chronicle.environments.get",
"chronicle.legacyPlaybooks.get",
"chronicle.legacySoarSettings.get",
"chronicle.integrationInstances.get",
"chronicle.integrationActions.get",
"chronicle.legacyCaseFederationPlatforms.get",
"chronicle.legacySoarDashboards.get",
"chronicle.legacySoarDashboards.update",
"chronicle.legacySoarReports.get",
"chronicle.legacySoarReports.update",
"chronicle.legacySoarReports.delete"

Autorisations d'afficher les rapports avancés

Pour afficher les rapports avancés, vous devez disposer des autorisations suivantes :

"chronicle.environments.get",
"chronicle.legacyPlaybooks.get",
"chronicle.legacySoarSettings.get",
"chronicle.integrationInstances.get",
"chronicle.integrationActions.get",
"chronicle.legacyCaseFederationPlatforms.get",
"chronicle.legacySoarAdvancedReports.get",
"chronicle.legacySoarReports.get"

Autorisations de modifier les rapports avancés

Pour autoriser la modification des rapports avancés, vous devez disposer des autorisations suivantes :

"chronicle.environments.get",
"chronicle.legacyPlaybooks.get",
"chronicle.legacySoarSettings.get",
"chronicle.integrationInstances.get",
"chronicle.integrationActions.get",
"chronicle.legacyCaseFederationPlatforms.get",
"chronicle.legacySoarAdvancedReports.update",
"chronicle.legacySoarAdvancedReports.share",
"chronicle.legacySoarAdvancedReports.get",
"chronicle.legacySoarAdvancedReports.delete",
"chronicle.legacySoarReports.get",
"chronicle.legacySoarReports.update"

Autorisations pour l'ontologie

Pour afficher l'ontologie, vous devez disposer des autorisations suivantes :

"chronicle.mappingRules.get",
"chronicle.ontologyRecords.get",
"chronicle.visualFamilies.get"

Autorisations permettant d'accéder à l'écran de configuration des événements

Pour accéder à l'écran de configuration des événements dans l'ontologie, vous devez disposer des autorisations suivantes :

"chronicle.mappingRules.get",
"chronicle.mappingRules.update",
"chronicle.mappingRules.delete",
"chronicle.ontologyRecords.get",
"chronicle.ontologyRecords.update",
"chronicle.visualFamilies.get",
"chronicle.visualFamilies.update",
"chronicle.visualFamilies.delete"

Autorisations pour l'IDE

Pour utiliser l'IDE, vous devez disposer des autorisations suivantes :

"chronicle.legacyPlaybooks.get",
"chronicle.legacySoarSettings.get",
"chronicle.legacySoarSettings.update",
"chronicle.marketplaceIntegrations.get",
"chronicle.marketplaceIntegrations.uninstall",
"chronicle.marketplaceIntegrations.install",
"chronicle.contentPacks.get",
"chronicle.contentPacks.delete",
"chronicle.contentPacks.create",
"chronicle.contentPacks.install",
"chronicle.contentPacks.export",
"chronicle.managers.update",
"chronicle.managers.get",
"chronicle.managers.delete",
"chronicle.managerRevisions.update",
"chronicle.managerRevisions.get",
"chronicle.managerRevisions.delete",
"chronicle.jobs.update",
"chronicle.jobs.get",
"chronicle.jobs.delete",
"chronicle.jobRevisions.get",
"chronicle.jobRevisions.update",
"chronicle.jobRevisions.delete",
"chronicle.integrations.update",
"chronicle.integrations.get",
"chronicle.integrations.delete",
"chronicle.integrationInstances.update",
"chronicle.integrationInstances.get",
"chronicle.integrationInstances.delete",
"chronicle.connectors.get",
"chronicle.connectors.update",
"chronicle.connectors.delete",
"chronicle.connectorRevisions.update",
"chronicle.connectorRevisions.delete",
"chronicle.connectorRevisions.get",
"chronicle.integrationActions.get",
"chronicle.integrationActions.update",
"chronicle.integrationActions.delete",
"chronicle.integrationActions.run",
"chronicle.integrationActionRevisions.update",
"chronicle.integrationActionRevisions.delete",
"chronicle.integrationActionRevisions.get",
"chronicle.integrationLogicalOperatorRevisions.delete",
"chronicle.integrationLogicalOperatorRevisions.get",
"chronicle.integrationLogicalOperatorRevisions.update",
"chronicle.integrationLogicalOperators.delete",
"chronicle.integrationLogicalOperators.execute",
"chronicle.integrationLogicalOperators.get",
"chronicle.integrationLogicalOperators.update",
"chronicle.transformerDefinitions.create",
"chronicle.transformerDefinitions.delete",
"chronicle.transformerDefinitions.execute",
"chronicle.transformerDefinitions.get",
"chronicle.transformerDefinitions.list",
"chronicle.transformerDefinitions.update",
"chronicle.transformerRevisions.delete",
"chronicle.transformerRevisions.get",
"chronicle.transformerRevisions.update"

Autorisations pour tous les environnements

Pour gérer tous les environnements, vous devez disposer des autorisations suivantes :

"chronicle.environments.get",
"chronicle.environments.update",
"chronicle.environmentGroups.get",
"chronicle.environmentGroups.update",
"chronicle.environmentGroups.delete"

Autorisations pour le SLA

Cette section traite des autorisations liées aux contrats de niveau de service (SLA).

Autorisations pour suspendre et reprendre les SLA

Pour autoriser la mise en pause et la reprise des SLA, vous devez disposer des autorisations suivantes :

"chronicle.cases.get",
"chronicle.cases.update",
"chronicle.caseAlerts.get",
"chronicle.caseAlerts.updateSla"