Default Roles

The system provides several default roles. If you have the Manage Roles permission, you can change the permissions of any role assigned to your account except for those of the System Admin. You can also create additional roles that reflect your organization’s needs.

Some permissions are available with specific functionality, such as Reports or Search, or when you have a particular license, such as for ArcSight Intelligence.

As of the ArcSight Platform 22.1 release, some roles are no longer default roles. However, the system continues to display them if you deployed your environment before the roles were deprecated. For example, ArcMC User, Guest, User, and Report User are no longer default roles.
Default Role Permissions

System Admin

Not available to customers in the ArcSight SaaS environment.

All permissions

Add, edit, and delete data sources in the Reports Portal

Admin

All Dashboard permissions

All Licensing and Usage permissions

All Reports permissions

All Searches permissions

All User Management permissions

Access Database Monitoring-Overview

Get Registration URL

All SOAR Configuration permissions

Analyst

All Dashboard permissions

Execute Search

Manage Fieldsets

Manage Search Queries/Criteria

Schedule Reports

View Reports

All Case Management permissions

System Operations Administrator

Not available to customers in the ArcSight SaaS environment.

Access Database Monitoring-Overview

Access Database Monitoring-Details

All Dashboard permissions

All ArcMC permissions

Manage Kafka

SCIM Integration Read-Only

Not available to customers in the ArcSight SaaS environment.

Not created in other environments

View Users