> For the complete documentation index, see [llms.txt](https://docs.enginsight.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enginsight.com/docs/manual/english/administration/permission-management.md).

# Permission Management

Permission management in Enginsight is based on assigning roles, which in turn have different permissions assigned to them. Enginsight distinguishes between [system roles](#system-roles) and [custom roles](#custom-roles).

***

## System Roles

The Enginsight platform provides four system roles with different read and write permissions:

<table><thead><tr><th width="199.60546875">Role</th><th>Description</th></tr></thead><tbody><tr><td>Owner</td><td>The <strong>Owner</strong> role has full access to all areas and functions, including license purchasing and license management.</td></tr><tr><td>Administrator</td><td>The <strong>Administrator</strong> role has full access to all main areas and functions, except for license purchasing and license management.</td></tr><tr><td>Operator</td><td>The <strong>Operator</strong> role has read access to Hosts, Endpoints, and Observations, and write access to Alerts and Issues.</td></tr><tr><td>Guest</td><td>The <strong>Guest</strong> role has read-only access to Hosts, Endpoints, and Observations.</td></tr></tbody></table>

Permissions for the individual system roles are defined as follows:

* 🟩 **Write access**: The role has write permissions and can perform actions such as creating or deleting objects.
* 🟨 **Read access**: The role has read permissions and can view items and objects.
* ⬜️ **No access**: The role has neither read nor write permissions.

### Permissions: Platform

|                   | Owner | Administrator | Operator | Guest |
| ----------------- | :---: | :-----------: | :------: | :---: |
| Dashboard         |   🟩  |       🟩      |    🟨    |   🟨  |
| Issues            |   🟩  |       🟩      |    🟩    |   🟨  |
| Hosts             |   🟩  |       🟩      |    🟨    |   🟨  |
| Endpoints         |   🟩  |       🟩      |    🟨    |   🟨  |
| Observations      |   🟩  |       🟩      |    🟨    |   🟨  |
| Shield            |   🟩  |       🟩      |    ⬜️    |   ⬜️  |
| Penetration Tests |   🟩  |       🟩      |    ⬜️    |   ⬜️  |
| Discoveries       |   🟩  |       🟩      |    ⬜️    |   ⬜️  |
| SIEM              |   🟩  |       🟩      |    🟨    |   🟨  |
| Alerts            |   🟩  |       🟩      |    🟩    |   🟨  |

### Permissions: Settings

|                                     | Owner | Administrator | Operator | Guest |
| ----------------------------------- | :---: | :-----------: | :------: | :---: |
| User Account                        |   🟩  |       🟩      |    🟩    |   🟩  |
| Password                            |   🟩  |       🟩      |    🟩    |   🟩  |
| Multi-Factor Authentication         |   🟩  |       🟩      |    🟩    |   🟩  |
| Roles                               |   🟩  |       🟩      |    ⬜️    |   ⬜️  |
| Responsibilities                    |   🟩  |       🟩      |    ⬜️    |   ⬜️  |
| Access Keys                         |   🟩  |       🟩      |    ⬜️    |   ⬜️  |
| Groups                              |   🟩  |       🟩      |    ⬜️    |   ⬜️  |
| Payment Methods (SaaS)              |   🟩  |       ⬜️      |    ⬜️    |   ⬜️  |
| Plans (SaaS)                        |   🟩  |       ⬜️      |    ⬜️    |   ⬜️  |
| Invoices (SaaS)                     |   🟩  |       ⬜️      |    ⬜️    |   ⬜️  |
| Licensees (On-Premises)             |   🟩  |       ⬜️      |    ⬜️    |   ⬜️  |
| Contingent Management (On-Premises) |   🟩  |       ⬜️      |    ⬜️    |   ⬜️  |
| Support                             |   🟩  |       ⬜️      |    ⬜️    |   ⬜️  |

***

## Custom Roles

Under **Settings** → [Roles](/docs/manual/english/administration/settings/roles.md), you can create custom roles with individually assigned permissions.

### Structure of a Permission

Every permission follows the same structure.

First, the [object](#objekte) to which the permission applies is defined, followed by an underscore and the [permission type](#zugriffsrechte) itself:

`<OBJECT>_<PERMISSION>`, for example: `INVENTORY_VIEW`.

### Permission Types

{% hint style="warning" %}
**Please note:** Not all permission types are available for every [object](#objekte).
{% endhint %}

The following permission types are available:

<table><thead><tr><th width="209.84375">Permission</th><th>Description</th></tr></thead><tbody><tr><td>*</td><td>The role has all permissions for the corresponding object.</td></tr><tr><td>CREATE</td><td>The role can create corresponding objects, generate items (for example, reports), or start actions (for example, audits).</td></tr><tr><td>EDIT</td><td>The role can edit corresponding objects.</td></tr><tr><td>REBOOT</td><td>The role can restart corresponding objects.</td></tr><tr><td>REMOVE</td><td>The role can delete corresponding objects.</td></tr><tr><td>UPDATE</td><td>The role can update corresponding objects.</td></tr><tr><td>VIEW</td><td>The role can view corresponding objects.</td></tr></tbody></table>

### Objects

[Permissions](#zugriffsrechte) can be assigned for the following objects.

#### Cross-Platform Objects

<table><thead><tr><th width="209.765625">Object</th><th>Meaning</th></tr></thead><tbody><tr><td>*</td><td>All objects</td></tr><tr><td>PDFREPORTS</td><td>PDF reports</td></tr></tbody></table>

#### **Dashboard**

<table><thead><tr><th width="250.3671875">Object</th><th>Meaning</th></tr></thead><tbody><tr><td>CONFIGURATIONLISTS</td><td>Configuration lists</td></tr><tr><td>CONFIGURATIONPOLICIES</td><td>Configuration policies</td></tr></tbody></table>

#### **Hosts**

<table><thead><tr><th width="210.3125">Object</th><th>Meaning</th></tr></thead><tbody><tr><td>HOSTS</td><td>Hosts (servers and clients)</td></tr><tr><td>PLUGINS</td><td>Plugins (custom scripts)</td></tr></tbody></table>

#### Endpoints

<table><thead><tr><th width="210.2109375">Object</th><th>Meaning</th></tr></thead><tbody><tr><td>ENDPOINTS</td><td>Endpoints (websites and domains)</td></tr></tbody></table>

#### **Observations**

<table><thead><tr><th width="210.40234375">Object</th><th>Meaning</th></tr></thead><tbody><tr><td>OBSERVATIONS</td><td>Observations (ping, port, and SNMP monitoring)</td></tr><tr><td>WATCHDOG</td><td>Enginsight component Watchdog</td></tr></tbody></table>

#### **Shield**

<table><thead><tr><th width="210.37109375">Object</th><th>Meaning</th></tr></thead><tbody><tr><td>SHIELD</td><td>Shield (Intrusion Prevention System; IPS)</td></tr></tbody></table>

#### Penetration Tests

<table><thead><tr><th width="209.78515625">Object</th><th>Meaning</th></tr></thead><tbody><tr><td>AUDITS</td><td>Penetration test results</td></tr><tr><td>AUDITTEMPLATES</td><td>Audit templates (audit definitions)</td></tr><tr><td>AUTHPROVIDERS</td><td>Target system credentials</td></tr><tr><td>HACKTORS</td><td>Enginsight component Hacktor</td></tr><tr><td>PENTEST</td><td>Execution of penetration tests</td></tr><tr><td>TARGETGROUPS</td><td>Target groups (target systems)</td></tr></tbody></table>

#### **Discovery**

<table><thead><tr><th width="209.73046875">Object</th><th>Meaning</th></tr></thead><tbody><tr><td>DISCOVERIES</td><td>Asset discovery</td></tr><tr><td>INVENTORY</td><td>Asset inventory</td></tr><tr><td>WATCHDOG</td><td>Enginsight component Watchdog</td></tr></tbody></table>

#### SIEM

<table><thead><tr><th width="209.75390625">Object</th><th>Meaning</th></tr></thead><tbody><tr><td>SIEM</td><td>Entire Enginsight Security Information and Event Management (SIEM)</td></tr><tr><td>SIEM_OBFUSCATORS</td><td>Obfuscators for masking data</td></tr></tbody></table>

#### **Alerts**

<table><thead><tr><th width="210.3671875">Object</th><th>Meaning</th></tr></thead><tbody><tr><td>ALERTS</td><td>Alerts</td></tr><tr><td>WEBHOOKS</td><td>Webhooks for third-party integration</td></tr><tr><td>ISSUES</td><td>Issues</td></tr><tr><td>MAINTENANCES</td><td>Maintenance periods</td></tr></tbody></table>

#### **Settings**

<table><thead><tr><th width="212.64453125">Object</th><th>Meaning</th></tr></thead><tbody><tr><td>ACCOUNT</td><td>Own user account</td></tr><tr><td>ACCESSKEYS</td><td>Access keys</td></tr><tr><td>GROUPS</td><td>User groups</td></tr><tr><td>INVOICES</td><td>Invoices (SaaS)</td></tr><tr><td>ORGANISATIONS</td><td>Organizations</td></tr><tr><td>PAYMENTMETHODS</td><td>Payment methods (SaaS)</td></tr><tr><td>ROLES</td><td>Roles</td></tr><tr><td>SUBSCRIPTIONS</td><td>Plans (SaaS)</td></tr><tr><td>MEMBERS</td><td>Team members</td></tr><tr><td>LICENSE</td><td>Licenses and contingent management (on-premises)</td></tr><tr><td>USERS</td><td>Users</td></tr></tbody></table>

***