Roles and permissions
Foxborne has five fixed roles, from admin to auditor. Each carries a fixed set of permissions, so an audit can reason about who could import, edit, approve, export or read the audit log.
On this page7
Each person in Foxborne holds one of five roles: admin, investigator, reviewer, viewer or auditor. The permissions of each role are fixed, so an audit can reason about them.
The five roles#
| Role | What it does | SCIM group |
|---|---|---|
| Admin | Runs the deployment: sources, hosting, access, retention and rules. | foxborne-admins |
| Investigator | Imports runs, opens incidents, annotates evidence and writes reports. | foxborne-investigators |
| Reviewer | Reads everything an investigator can, comments and approves reports. | foxborne-reviewers |
| Viewer | Reads approved reports and their evidence. Cannot import or edit. | foxborne-viewers |
| Auditor | Reads the audit log, exports and the evidence chain. Cannot edit. | foxborne-auditors |
The descriptions are the ones on the Roles tab under Access. Its Roles table gives each role's name, What it is for and the number of People who hold it.
Permissions#
The Permissions panel on the same tab carries the subtitle Fixed per role, so an audit can reason about them. A blank cell means the role does not hold the permission.
| Permission | Admin | Investigator | Reviewer | Viewer | Auditor |
|---|---|---|---|---|---|
| Import runs and files | Yes | Yes | |||
| Open and edit incidents | Yes | Yes | |||
| Inspect original evidence | Yes | Yes | Yes | Yes | Yes |
| Comment on reports | Yes | Yes | Yes | ||
| Approve reports | Yes | Yes | |||
| Export case files | Yes | Yes | Yes | Yes | |
| Read and download reports | Yes | Yes | Yes | Yes | Yes |
| Save, schedule and generate reports | Yes | Yes | Yes | ||
| Manage sources and collectors | Yes | ||||
| Change detection rules | Yes | ||||
| Save a parser for a new log format | Yes | ||||
| Read the audit log | Yes | Yes | |||
| Manage hosting, keys and access | Yes |
Who approves reports#
- Admins and reviewers hold Approve reports. Investigators write reports but cannot approve them.
- A request for review is recorded in the audit log as Requested review, with the reviewer's name.
- On the incident's Report tab, Approve report appears in the Report panel while the report is In review, for the reviewer named on that incident.
- The report's status chip reads Draft, In review or Approved. Viewers read approved reports and their evidence.
Who reads the audit log#
- Admins and auditors hold Read the audit log. The Audit log page gives them Verify chain and Export as well.
- An auditor reads the audit log, exports and the evidence chain, and cannot edit.
- Auditors also hold Inspect original evidence and Export case files, so they can check a report against its sources.
Evidence marked EXPT#
All five roles hold Inspect original evidence. Evidence marked EXPT also needs US person status: it opens only for users whose identity provider asserts it. See Export-controlled evidence.
Where roles are set#
| Where | How |
|---|---|
| Invite someone | Choose the Role when you invite. The list starts at Investigator. |
| Change role | From the person's row on Members. It takes effect on their next request. |
| SCIM | Membership of the matching Foxborne group in your identity provider. |
Change role writes Changed role to the audit log, with the person and the new role. An invitation writes Invited user, with the role as its detail.
Related#
- Invite, change and remove access walks through inviting, changing a role and removing access.
- SCIM provisioning maps the five groups in your identity provider to these roles.
- Write and review a report shows the review and approval steps.
- Audit log lists every action and who records it.