• Full Access: The full access role grants the user all possible privileges in terms of managing the Trend Cloud One services including creating, editing, and deleting resources, policies, rules, managing users and roles, and others.
• Auditor: The auditor role gives the user the ability to view all the information in the Trend Cloud One services, but without the ability to make any modifications except to their own personal settings, such as password, contact information, dashboard layout preferences, and others.
• Workload Security Read Only: This role has the same settings as the Auditor role, but this role cannot be modified. The Read Only role for new Trend Cloud One accounts is mapped to this role in Workload Security.
• Deep Security Migration: Role used by Deep Security software for migration to Workload Security. For details, see the Deep Security help.
• Trend Vision One: Role used by Trend Vision One.

Custom Workload Security rights

Clicking New () or Properties () displays the Role properties window with six tabs: General, Computer Rights, Policy Rights, User Rights, Other Rights, and Assigned To.

Add or edit a role

1. From the Trend Cloud One - Endpoint & Workload Security page, click Administration → User Management → Roles .
2. Click New to add a new role or double-click an existing role to edit its settings.
3. Specify the general properties for the role, including:
   • Name: The name of the role, which appears on the Roles page and in the list of available roles when adding a user.
   • Description: An optional description of the role.
   • Access Type: Select whether users with this role have access to the Deep Security Manager User Interface or the Web Service API.
4. Use the Computer Rights tab to set viewing, editing, deleting, alert-dismissal, and event tagging rights for users in a role. These rights can apply to all computers and computer groups or they can be restricted to only certain computers.
5. To restrict access, select Selected Computers and select the computer groups and computers to which users in this role have access. These rights restrictions affect not only the user's access to computers in Workload Security, but also what information is visible, including events and alerts. In addition, email notifications are only sent if they relate to data to which the user has access rights.
   
   Four basic options are available:
   • Allow viewing of non-selected computers and data: If users in this role have restricted edit, delete, or dismiss alerts rights, you can still allow them to view, but not change, information about other computers by selecting it.
   • Allow viewing of events and alerts not related to computers: Set this option to allow users in this role to view non-computer-related information (for example, system events like users being locked out, new firewall rules being created, IP Lists being deleted, and so on).
     The previous two options affect the data to which users have access. Although the ability of a user to make changes to computers have been restricted, the preceding two settings control whether the users can see information relating to computers they do not otherwise have access to. This includes receiving email notifications related to those computers.
   • Allow new computers to be created in selected Groups: Set this option to allow users in this role to create new computers in the computer groups to which they have access.
   • Allow sub-groups to be added/removed in selected Groups: Set this option to allow users in this role to create and delete subgroups within the computer groups to which they have access.
   You can also enabled the following in the Advanced Rights section:
   • Allow computer file imports: Allow users in this role to import computers using files created using Workload Security's Computer Export option.
   • Allow Directories to be added, removed and synchronized: Allow users in this role to add, remove, and synchronize computers that are being managed using an LDAP-based directory like Microsoft Active Directory.
   • Allow VMware vCenters to be added, removed and synchronized: Allow users in this role to add, remove and synchronize VMware vCenters.
6. Use the Policy Rights tab to assign viewing, editing, and deleting rights to users in a role. These rights can apply to all policies or they can be restricted to only certain policies. If you wish to restrict access, click Selected Policies and select the policies to which users in this role have access.
   
   When you allow rights to a policy that has child policies, users automatically get rights to the child policies as well.
   Two basic options are available:
   • Allow viewing of non-selected Policies: If users in this role have restricted edit or delete rights, you can still allow them to view, but not change information about other policies by making this selection.
   • Allow new Policies to be created: Set this option to allow users in this role to create new policies.
   You can also enable this in the Advanced Rights section:
   • Allow Policy imports: Allow users in this role to import policies using files created with Workload Security Export option on the Policies tab.
7. The options on the User Rights tab allow you to define permissions for administrator accounts.
   
   • Change own password and contact information only: Users in this role can change their own password and contact information only.
   • Create and manage Users with equal or less access: Users in this role can create and manage any users who do not have any privileges greater than theirs. If there is even a single privilege that exceeds those of the users with this role, the users with this role cannot create or manage them.
   • Have full control over all Roles and Users: Gives users in this role the ability to create and edit and users or roles without restrictions. Be careful when using this option: if you assign it to a role, you may give a user with otherwise restricted privileges the ability to create and then sign in as a user with full unrestricted access to all aspects of Workload Security.
   • Custom: You can further restrict the ability of a user to view, create, edit, or delete users and roles by selecting Custom and using the options in the Custom Rights section. Some options may be restricted for certain users if the Can only manipulate Users with equal or lesser rights option is selected.
     The Can only manipulate Users with equal or lesser rights option limits the authority of users in this role. They can only make changes to users that have equal or lesser rights than themselves. Users in this role cannot create, edit, or delete roles. Selecting this option also places restrictions on some of the options in the Custom Rights section:
     • Can Create New Users: Can only create users with equal or lesser rights.
     • Can Edit User Properties: Can only edit a user (or set or reset password) with equal or lesser rights.
     • Can Delete Users: Can only delete users with equal or lesser rights.
8. The Other Rights tab enables you to restrict roles' permissions so that they can only access specific Workload Security features, and sometimes specific actions with those features. This can be useful if, for example, you have a team of administrators, and you want to make sure that they do not accidentally overwrite each others' work. By default, roles are View Only or Hide for each feature. To allow to full control or customized access, select Custom from the list.
   
9. The Assigned To tab displays a list of the users who have been assigned this role. If you want to test that roles are working correctly, sign in as a newly created user and verify the functionality.

Default settings for full access, auditor, and new roles