Creating administrator profiles for incident & event management

Incident and event profile permissions allow security analysts to access the Incidents & Events module while preventing them from making changes to configurations that will affect the SLA.

To create an analyst profile:

1. Go to System Settings > Admin Profiles.
2. In the toolbar, click Create New.
3. In the Profile Name field, give the profile a distinctive name such as, Analyst.
4. Set Incidents & Events to Read-Only.
5. Set one or more of the following settings to Read-Write.

   Permission	Description
   Create & Update Incidents	Allows analysts to create and update incidents.
   Triage Event	Allows analysts to acknowledge, comment, view logs, create new incidents, and add to existing incidents.
   Execute Playbook	Allows analysts to view and run a playbook.
   Run Report	Allows analysts to view, run, and export a report.

6. Configure the other settings as required, and click OK.

To apply a profile to an administrator:

1. Go to System Settings > Administrators.
2. Create a new administrator or edit an existing administrator. The Edit Administrator pane is displayed.
3. From the Admin Profile list, select a profile.