Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
 

Assigning User Permissions for QRadar Use Case Manager

After you install the QRadar Use Case Manager, you can share the app with non-administrative users by adding it to a user role.

After you install QRadar Use Case Manager, it is displayed as a capability in the User Roles window on the Admin tab. Capabilities are sets of permissions that user roles have. To use the app, a QRadar administrator must assign the app, and any other capabilities that it requires, to a user role.

  1. Click User Roles on the Admin tab.
  2. On the User Roles window, select the user role that you want to assign the app permissions to.
  3. Select the checkbox for QRadar Use Case Manager and the permissions in the following table.

    User permission

    Capabilities

    Offenses

    View Custom Rules

    Read-only access to offense rules

     

    Maintain Custom Rules

    Full access to offense rules, including ability to edit MITRE mappings.

    Log Activity

    View Custom Rules

    Read-only access to common, event, and anomaly rules

     

    Maintain Custom Rules

    Full access to common, event, and anomaly rules, including ability to edit MITRE mappings.

    Network Activity

    View Custom Rules

    Read-only access to common, flow, and anomaly rules

     

    Maintain Custom Rules

    Full access to common, flow, and anomaly rules, including ability to edit MITRE mappings.

    Offenses

    The trend charts on the home page and the tuning active rules feature.

    Delegated Administration

    Define Network hierarchy

    View and edit the Check Network Hierarchy page and any link that opens Network Hierarchy.

     

    Manage Reference Data

    Edit reference sets.

    Log Activity

    View and edit R2R (Remote to Remote) events and tuning based on CRE reports.

    The level of rule permissions assigned to a user affects what they can do and see in the following pages:

    • Use Case Explorer

    • Active Rules

    • Tuning home page

    • CRE Event Report

    • Network Hierarchy

    • Host Definitions

  4. Click Save, and then click Deploy Changes so that your user role updates take effect.