SOAR platform workspaces

You can create and configure workspaces to assign different incidents to different teams. You can use this feature to assign incidents based on responsibilities, where only the teams and users responsible for particular incidents can see and act on those incidents.

Workspaces serve as containers or partitions for grouping different incidents. You can use the feature to manage incidents more efficiently across multiple teams and also within teams. They provide the flexibility to assign particular incidents to specific teams, restricting access and control to only the teams and users that need it. For example, you might create and configure a workspace for the Security team and a second workspace for the IT Operations team. Within these two workspaces, each team manages their security or IT operations incidents separately and independently.

Within each workspace, you can set up and assign workspace roles to ensure that appropriate permissions are granted to particular users. Workspace roles are a set of incident-based permissions that are granted to users in the context of particular workspaces. For example, you can assign View, Edit, and Delete permissions to a team lead role in a workspace, and grant View and Edit permissions only to other users within that workspace. You can reuse workspace roles across workspaces. For example, you can create a ‘Team Lead Role’, and use this role to grant the same permissions to team leaders in a number of workspaces.

Workspaces also provide the flexibility to assign different roles to users in different workspaces. For example, you can assign a workspace role to a user for one workspace and a different workspace role to the same user for another workspace. Users with the correct permissions can also escalate incidents from one workspace to another.
Note: If you do not implement workspaces, they have no impact on your deployment. All incidents and roles are contained in the default workspace and no configuration is necessary.

Workspaces key concepts

There is at least one workspace on the system. The default workspace automatically contains all of the incidents on the system.

Review the following behaviors for workspaces.
  • A global permission for workspaces is available. Users with this global permission can create and manage workspaces. Administrators with the Roles permission can assign this permission to other roles from Administrator Settings > Global Roles > Workspaces.
  • When you create a new incident, users with permissions to create incidents can select the workspace to which they want to assign the incident. However, the New Incident wizard must include the Workspace field. Playbook designers can add the Workspace field to layouts, as needed. For more information, see the Playbook Designer Guide.
  • Users with the proper permissions can reassign incidents from one or more workspaces to another. For more information about reassigning incidents to a different workspace, see the User Guide.
  • Users can filter incidents by workspace from the Incidents screen.
  • Organization level permissions that are granted through global roles are aggregated to permissions that are granted through workspace roles. For example, a user with View Incidents permissions that are granted through a workspace role and Create Incident permissions that are granted through a global role can create incidents in any workspace.
  • Data that is presented in the widgets on the Analytics Dashboard is limited to only the workspaces to which the user has access.

Creating a workspace

You set up and manage workspaces from Administrator Settings > Workspaces. The first time that you access Administrator Settings > Workspaces, the default workspace is displayed. All existing incidents are automatically assigned to this workspace.

About this task

To create a workspace,

Procedure

  1. Click Administrator Settings > Workspaces.
  2. Click Create Workspace.
  3. Enter a name, API name, and if wanted, a description for the workspace.
  4. If you want this workspace to be the default workspace, check the Default Workspace box.

Results

After you create a workspace, you can proceed to create workspace roles, assign workspace roles to users and groups, remove global permissions as necessary, and add the workspace field to layouts.

Deleting a SOAR workspace

You can delete workspaces, including any default workspaces. However, there must be at least one other workspace, and the workspace does not have any assigned incidents (open or closed). If you want to delete the default workspace, you must first assign another workspace as the default.

About this task

You might not be able to delete a workspace with a dependency on a rule, script, or workflow. A message displays if you attempt to delete a workspace with a dependency.

To delete a workspace,

Procedure

  1. Go to Administrator Settings > Workspaces.
  2. Click the delete icon for the workspace that you want to delete. Review the message that is displayed. You cannot delete a workspace with any assigned incidents. You must reassign the incidents to another workspace and try again.
  3. Click Delete Workspace to confirm the removal of the workspace.