Revoking the Super User Role from a New User

You must have at least one user with the Super User role assigned within the SOAR feature.

By default, the SOAR feature (Respond) assigns the Super User role to each new user. However, neither the Super User role nor any other roles assigned within Respond applies to other functions within ArcSight SaaS. We recommend that you change the new user's role from Super User to a role that has lesser privileges. For example, create an empty role within the SOAR feature, and then assign it to new users.

To change a new user role from the Super User role to an empty role:

  1. Select Respond.
  2. Select Configuration > Parameters.

  3. For ArcSightUserRole, select Empty Role for the new user.