Permission precedence

Permission precedence determines which security profile components to consider when the system displays events in the Log Activity tab and flows in the Network Activity tab.

Choose from the following restrictions when you create a security profile:

  • No Restrictions - This option does not place restrictions on which events are displayed in the Log Activity tab, and which flows are displayed in the Network Activity tab.
  • Network Only - This option restricts the user to view only events and flows that are associated with the networks that are specified in this security profile.
  • Log Sources Only - This option restricts the user to view only events that are associated with the log sources that are specified in this security profile.
  • Networks AND Log Sources - This option allows the user to view only events and flows that are associated with the log sources and networks that are specified in this security profile.

    For example, if the security profile allows access to events from a log source but the destination network is restricted, the event is not displayed in the Log Activity tab. The event must match both requirements.

  • Networks OR Log Sources - This option allows the user to view events and flows that are associated with either the log sources or networks that are specified in this security profile.

For example, if a security profile allows access to events from a log source but the destination network is restricted, the event is displayed on the Log Activity tab if the permission precedence is set to Networks OR Log Sources. If the permission precedence is set to Networks AND Log Sources, the event is not displayed on the Log Activity tab.

Permission precedence for offense data

Security profiles automatically use the Networks OR Log Sources permission when offense data is shown. For example, if an offense has a destination IP address that your security profile permits you to see, but the security profile does not grant permissions to the source IP address, the Offense Summary window shows both the destination and source IP addresses.