Prerequisites
Creating, editing, and deleting roles requires themanage_roles capability. This capability is included in the built-in admin role.
Role Types
Permission Roles
Grant one or more capabilities to every user who holds the role. Authorization decisions throughout ThreatLab are driven entirely by permission roles.
Title Roles
Cosmetic only — examples include SOC Lead or Instructor. They appear as badges on user profiles but grant no capabilities and have no effect on what a user can do.
System Roles
The built-in
admin and analyst roles are immutable (is_system = true). They cannot be edited or deleted. The admin role grants every capability; analyst grants none by default.Creating a Role
- Permission Role
- Title Role
1
Open the Roles panel
Navigate to Admin > Roles and click New Role.
2
Name and describe the role
Enter a name and an optional description that explains the role’s purpose.
3
Choose a color
Pick a color for the role badge displayed on user profiles.
4
Set the kind
Set Kind to Permission.
5
Select capabilities
Check each capability you want to grant. See the Capabilities Reference table below.
6
Save
Click Save. The role is immediately available to assign to users.