Users, Roles & Permissions

Nucleus is designed for users to have finegrained access roles and permissions to support the limited-access use cases that organizations need to build and run an effective vulnerability management program. 

This article provides an explanation of users and their user access roles and permissions, and assumes an understanding of the concepts Organizations, Projects and Asset Groups.

Users

Users exist within a Nucleus Organization and are centrally managed at that logical level. Users can be a part of multiple organizations within one or more Nucleus instances, although typically a user only has access to a single organization in a single instance unless they are an administrator using Nucleus for Managed Security Service Providers (MSSPs).

Users can be provisioned manually to organizations from the UI, and can also be automatically provisioned to an organization using Single Sign-On (SSO) with Just-in-Time (JIT) provisioning.

Once a user is part of an organization, they can then be allocated roles in projects manually in the UI, or automatically using SSO group or role mappings.

Nucleus is designed to support the unique roles and requirements needs organizations have for vulnerability management. In Nucleus, you'll define fine-grained roles within each project to meet your specific roles and requirements.

User Access Roles

Nucleus Organization administrators have the ability to create user access roles. Each user access role is a set of permissions that determines what actions users with that role can perform in projects.

User access roles are defined within a Nucleus organization, and can be applied to multiple users within the same project, as well as one or more users across different projects. Users can have different user access roles for different projects, but no more than one role defined per project at a time.

Once a user has been assigned a role within a project, their access can further be restricted to a subset of assets in the project by using Asset Group Access Control (AGAC), either directly applied to their user account, or by adding that user to a team and restricting the team's access with AGAC. Please see the article Asset Group Access Control for how to configure this for users your project.

Pre-defined roles

Nucleus provides a set of pre-defined user access roles for getting started within the platform. These roles cannot be modified or deleted, but do not have to be used. See the Defining new roles section for creating and using custom roles.

Organization Admin

The Organization Admin role is the highest-level super-user role responsible for administering the entire organization within Nucleus, with full-access permission to all projects in the organization. The Org Admin has control over all other users and their roles, access permission levels, and risk management settings:

• User management control to invite, edit, enable, disable and delete users, and provision API accounts;
• Role management control to create, update and delete roles with custom permission options as well as link the roles to groups or match roles defined in the organization's Single Sign-On (SSO) provider; and
• Organization-wide risk management control to set default risk settings for each project.

Organization Admins also have control over reporting, templates, and logs to:

• Generate global reports;
• Create, update and delete custom finding templates;
• Manage organization-wide automation;
• View organization-wide connector activity; and
• View an organization-wide activity log.

Project Admin

The Project Admin role is a super-user role scoped to a specific project. This role gives the user complete access to view and modify all data within a project, and can be used to configure connectors, automation, reports and teams.

General User

The General User role is a power-user role intended for vulnerability analysts that run a vulnerability management program.

This role provides a similar set of permissions to the Project Admin role, but does not allow some organizational or destructive permissions.

For example, this role cannot perform team management, remove scan data or reports, edit project settings or asset risk attributes.

Asset Group Restricted User

The Asset Group Restricted User role provides a set of permissions that are best suited to users that will be restricted to a subset of assets within a project through the user of Asset Group Access Control (AGAC), such as application owners and vulnerability remediators.

Auditor

The Auditor role is predominantly a read-only role that is best suited to observers that need to view asset and finding data, generate reports, and add comments and evidence to findings.

Default Role

The default role is the role automatically assigned to a user when they are added to a project and no explicit role is set. A default role can be set from Global Console -> Administration -> Roles. Select a row and then choose the edit pencil under Action.

SSO and Manual role assignments

Please note that if a user is manually assigned a role using single-sign-on (SSO) and the project-role mapping is subsequently removed, the user will revert to having no role. If this occurs, you can assign the user a new role manually under Project Administration -> Users.

Defining new roles

New user access roles can be defined by Organization Admins. Roles can be created anew, and can also be cloned from an existing role and later modified.

Steps to create a new role

1. Go to Global Dashboard > Global Administration > Roles.
2. Click Add Role along the top navigation bar.
   
3. In the pop-up modal, add a name and description to the role and select the permissions applicable to this role.
4. Click the blue Save button to complete the process.

Steps to clone existing roles

1. Go to Global Dashboard > Global Administration > Roles.
2. Look in the list for a role closest to the role you want to create. 
3. In the Action column, click the Clone icon. This opens the same pop-up as when creating a new role, with the permissions pre-populated based on that role. 
4. Modify the role as appropriate.
5. Click the blue Save button to complete the process.

Permissions

This section provides an overview of all permissions available to roles within Nucleus. Permissions are fixed, and custom permissions cannot be created.

AI

API

Assessments

Assets

Connectors

Findings

Notifications

Org Administration

Projects

Reports

Scans

Social

Teams