List of Built-in Roles

To create a new custom role, see Create a Custom Role.

xorlab role	Identifier	Capabilities
User	`xcc_analyst`	- Release emails from quarantine - Reanalyze/Unlock emails - Send feedback for reported incidents - Submit misclassification reports - Create, delete, or modify search queries and campaigns - Update custom tags for messages, reported incidents, and uploaded files - Upload a file for analysis
User (Tenant-Restricted)	`xcc_tenant_analyst`	This user can only access resources on their own tenant and can: - Release emails from quarantine - Reanalyze/Unlock emails - Send feedback for reported incidents - Submit misclassification reports - View campaigns and saved searches (no modifications) - Update custom tags for messages, reported incidents, and uploaded files - Upload a file for analysis
Auditing User	`xcc_analyst_audit`	- View messages, reported cases, and analyzed files - View campaigns and saved searches - View the custom tags of messages - View items from black- and whitelists in the web interface - View configuration lists in Expert Editor
Auditing User (Tenant-Restricted)	`xcc_tenant_analyst_audit`	This user can only access resources on their own tenant and can: - View messages, reported cases, and analyzed files - View campaigns and saved searches - View the custom tags of messages - View items from black- and whitelists in the web interface - View configuration lists in Expert Editor
Admin	`xcc_admin`	- Isolate messages from user mailboxes - Modify black- and whitelists in the web interface - Edit configuration lists in Expert Editor - Start a new backup and check the status of the running process - Edit system configurations - Other power user capabilities
Auditing Admin	`xcc_admin_audit`	- Everything that an `Auditing User` can view - View system configurations and backup status
Self-Service Quarantine User	`xcc_quarantine_user`	- Authenticate and log in via the web interface - Change basic settings such as white/black theme - View emails in the `Malware`, `Extortion`, `Policy` and `Impersonation` quarantine - View and release emails from the `Phishing` and `Spam` quarantine.
Insights User	`xcc_insights`	Access to the statistics dashboards in the Insights section
Monitoring User	`xcc_monitor`	Access to `/monitoring` (Grafana)

Multi-Tenancy

The two tenant-restricted roles, xcc_tenant_analyst and xcc_tenant_analyst_audit, exist for multi-tenant deployments. A user with one of these roles only sees the resources of the tenant they are assigned to. The tenant assignment does not come from the role itself: it comes from the tenant attribute your authentication backend maps for the user, which must match the name of a tenant in guarded_tenants.yml. See Enable Tenant Login for the mapping in SAML, LDAP and password file backends.

​Multi-Tenancy

Multi-Tenancy