Skip to content
LogoLogScale DocumentationFull LibraryKnowledge BaseRelease NotesIntegrationsTrainingAPIContacting Support
help

Versions of this Page

  • Falcon LogScale Cloud 1.112.1-1.117.0

  • Falcon LogScale Cloud 1.112.1-1.117.0

    • Cloud Overview
    • Getting Started
    • LogScale Cloud Admin.
      • S3 Archiving for LogScale Cloud
      • Data Retention
      • LogScale Internal Logging
      • Log LogScale to LogScale
      • Usage Management
        • What's Measured
        • Measuring Data Ingest
          • Data Not Measured
        • Optimizing Ingestion
        • Monitoring Usage
          • Measurement Repositories
      • Dynamic Configuration
    • Configuring Security
      • IP Filters
        • IP Filter Rules
        • Managing IP Filters
        • Creating an IP Filter
        • Editing an IP Filter
      • Security Policies
        • Dashboard Security Policies
        • API Token Security Policies
          • Behavior When Changing Token Security Policies
          • Personal API Token Security Policy
          • Repository and View API Tokens Security Policy
          • Organization API Tokens Security Policies
        • Actions Security Policies
        • Changing Actions Security Policies
          • Email Action Security Policy
          • OpsGenie Action Security Policy
          • PagerDuty Action Security Policy
          • Slack Action Security Policy
          • Upload file Action Security Policy
          • LogScale repository Action Security Policy
          • VictorOps Action Security Policy
          • Custom webhook actions Action Security Policy
      • API Tokens
        • Using API Tokens
          • Using an Expired API Token
          • Using an IP Filtered API Token
        • Repository and View API Tokens
          • Viewing Repository Tokens
          • Creating Repository API Tokens
          • Managing Repository API Tokens
        • Organization API Tokens
          • Viewing Organization API Tokens
          • Creating Organization API Tokens
          • Managing Organization API Tokens
      • Session Management
      • Audit Logging
      • Tokens in LogScale
    • Organization Essentials
      • Organization Settings
      • Organization Query Monitor
        • Query Stats
        • Query Details
        • Query Clients
        • Block & Kill
      • Blocking Queries
        • Add Query to Blocklist
        • Blocked Query Indications
    • Authentication & Identity Providers
      • Configure Identity Provider
      • SAML Authentication
        • Active Dir. Federation Svc.
        • Azure Active Dir.
        • Duo Security
        • Okta
        • PingFederate
      • OpenID Connect
    • Users & Permissions
      • Permission Levels
      • Managing Users
      • Managing Groups
        • Group Roles
        • Group Memberships
        • Group Synchronization
      • Managing Roles
      • Default Role Permissions
      • Repository & View Permissions
      • Organization Admin. Permissions
      • Supported Functionality
      • Functionality Requirements
    • Ingesting Data
      • Log Shippers
      • Backfilling Data
      • Disabling Ingestion
      • Ingest FDR Data
      • Ingest Tokens
    • LogScale URLs & Endpoints

  • Data Analysis 1.112.1-1.117.0

    • Data Analysis Overview
    • LogScale User Interface
      • Managing Your Account
    • Repositories & Views
      • Create a Repository
      • Repository Settings
      • Falcon LTR Repositories
      • Create a View
      • View Settings
      • Lookup Files
      • Delete Repositories & Views
    • Parsing Data
      • Built-in Parsers
      • Creating a Parser
      • Ingest Tokens
      • Multiple Repositories
      • Parser Errors
      • Removing Fields
      • Event Tags
      • Parsing Timestamps
    • Searching Data
      • Search Box
      • Event Fields
      • Display Fields
      • Select & Filter
      • Adding & Removing Fields
      • Inspect Events
      • Format Columns
      • Field Interactions
      • Different Visuals
      • Highlight Filter Match
      • Change Time Frame
      • Set Time Zone
      • Save Searches
      • Export Data
      • Event Display Methods
      • Search Status
      • Event List Interactions
    • Writing Queries
      • Basic Query Principles
      • Managing Queries
      • Common Queries
      • Writing Better Queries
      • Query Readability & Better Usage
      • Example Queries
    • Query Language Syntax
      • Query Filters
      • Operators
      • Adding Fields
      • User Parameters/Variables
      • Conditional Expressions
      • Query Joins
      • Array Syntax
      • Function Syntax
      • Time Syntax
        • Supported Timezones
        • Relative Time Syntax
      • Regular Expression Syntax
        • Regular Expression Syntax Patterns
        • Unsupported Regular Expression Patterns
        • Regular Expression Flags
        • Differences from Other Regex Implementations
    • Query Functions
      • Function Types and Arguments
      • Aggregate Query Functions
      • Array Query Functions
      • Comparison Query Functions
      • Condition Query Functions
      • Event & Data Manipulation Query Functions
      • Filtering Query Functions
      • Formatting Query Functions
      • Geolocation Query Functions
      • Hash Query Functions
      • Join Query Functions
      • Math Query Functions
      • Network & Location Query Functions
      • Parsing Query Functions
      • Regular Expression Query Functions
      • Statistics Query Functions
      • String Query Functions
      • Time & Date Query Functions
      • Widget Query Functions
      • array:contains()
      • array:eval()
      • array:filter()
      • array:intersection()
      • array:reduceAll()
      • array:reduceRow()
      • array:reduceColumn()
      • array:regex()
      • array:union()
      • asn()
      • avg()
      • base64Decode()
      • beta:param()
      • beta:repeating()
      • bitfield:extractFlags()
      • bucket()
      • callFunction()
      • cidr()
      • collect()
      • communityId()
      • concat()
      • concatArray()
      • copyEvent()
      • count()
      • counterAsRate()
      • createEvents()
      • crypto:md5()
      • default()
      • drop()
      • dropEvent()
      • duration()
      • end()
      • eval()
      • eventFieldCount()
      • eventInternals()
      • eventSize()
      • fieldset()
      • fieldstats()
      • findTimestamp()
      • format()
      • formatDuration()
      • formatTime()
      • geography:distance()
      • geohash()
      • groupBy()
      • hash()
      • hashMatch()
      • hashRewrite()
      • head()
      • holtwinters()
      • if()
      • in()
      • ioc:lookup()
      • ipLocation()
      • join()
      • json:prettyPrint()
      • kvParse()
      • length()
      • linReg()
      • lookup()
      • lower()
      • lowercase()
      • match()
      • math:abs()
      • math:arccos()
      • math:arcsin()
      • math:arctan()
      • math:arctan2()
      • math:ceil()
      • math:cos()
      • math:cosh()
      • math:deg2rad()
      • math:exp()
      • math:expm1()
      • math:floor()
      • math:log()
      • math:log10()
      • math:log1p()
      • math:log2()
      • math:mod()
      • math:pow()
      • math:rad2deg()
      • math:sin()
      • math:sinh()
      • math:spherical2cartesian()
      • math:sqrt()
      • math:tan()
      • math:tanh()
      • max()
      • min()
      • moment()
      • now()
      • parseCEF()
      • parseCsv()
      • parseFixedWidth()
      • parseHexString()
      • parseInt()
      • parseJson()
      • parseLEEF()
      • parseTimestamp()
      • parseUri()
      • parseUrl()
      • parseXml()
      • percentile()
      • range()
      • rdns()
      • regex()
      • rename()
      • replace()
      • round()
      • sample()
      • sankey()
      • select()
      • selectFromMax()
      • selectFromMin()
      • selectLast()
      • selfJoin()
      • selfJoinFilter()
      • series()
      • session()
      • shannonEntropy()
      • sort()
      • split()
      • splitString()
      • start()
      • stats()
      • stdDev()
      • stripAnsiCodes()
      • subnet()
      • sum()
      • table()
      • tail()
      • test()
      • time:dayOfMonth()
      • time:dayOfWeek()
      • time:dayOfWeekName()
      • time:dayOfYear()
      • time:hour()
      • time:millisecond()
      • time:minute()
      • time:month()
      • time:monthName()
      • time:second()
      • time:weekOfYear()
      • time:year()
      • timeChart()
      • tokenHash()
      • top()
      • transpose()
      • unit:convert()
      • upper()
      • urlDecode()
      • urlEncode()
      • wildcard()
      • window()
      • worldMap()
      • writeJson()
      • xml:prettyPrint()
    • Dashboards & Widgets
      • Managing Dashboards
      • Using Dashboards
      • Editing Dashboards
      • Managing Dashboard Parameters
      • Managing Dashboard Interactions
      • Exporting as PDF Report
        • PDF Export Options
      • Managing Dashboard Widgets
      • Widgets
        • Bar Chart Widget
        • Event List Widget
        • Gauge Widget
        • Heat Map Widget
        • Note Widget
        • Pie Chart Widget
        • Sankey Diagram Widget
        • Scatter Chart Widget
        • Single Value Widget
        • Table Widget
        • Time Chart Widget
        • World Map Widget
        • Embedding iFrame Widgets
    • Automation & Alerts
      • Alerts
        • Standard Alerts
        • Filter Alerts
        • Creating Alerts
        • Managing Alerts
        • Editing an Alert
        • Setting Alert Throttle Period
        • Sending Aggregate Results to Actions
        • Monitoring Alerts
        • Diagnosing Alerts
          • Errors when Using Live join() Functions
          • Monitor Alerts with humio-activity Repository
            • Alert Raw Event Example
      • Scheduled Searches
      • Actions
        • Action Activities
          • Creating Actions
          • Managing Actions
          • Deleting Actions
        • Action Type: Email
        • Action Type: Falcon LogScale Repository
        • Action Type: OpsGenie
        • Action Type: PagerDuty
        • Action Type: Postmark
        • Action Type: Slack
        • Action Type: Upload File
        • Action Type: VictorOps (Splunk On-Call)
        • Action Type: Webhooks
        • Message Templates and Variables
    • Template Language
      • Template Expressions
      • Template Variable Types
      • Template Examples
    • Keyboard Shortcuts
LogScale Cloud
Falcon LogScale Documentation
/ Falcon LogScale Cloud 1.112.1-1.117.0
/ Managing Users & Permissions

Default Role Permissions

LogScale includes a number of standard roles by default. These roles have the following permissions:

  • Admin Role

    • Data read access

    • Change connections for a view

    • Change dashboards

    • Change default search settings

    • Change files

    • Change interactions

    • Change permission tokens on repo or view

    • Change saved queries

    • Change shared dashboard URLs

    • Change view or repo description

    • Connect a view

    • Change FDR feeds

    • Change parsers

    • Change S3 archiving settings

    • Change event forwarding

    • Change packages

    • Change triggers and actions

    • Change data deletion permissions

    • Change user access

  • Deleter Role

    • Change data retention

    • Delete data sources

    • Delete events

    • Delete repository or view

  • Member Role

    • Data read access

    • Change dashboards

    • Change files

    • Change saved queries

    • Change parsers

    • Change triggers and actions

File last updated:
Support
  • Twitter
  • Slack
  • Facebook
  • LinkedIn
  • Youtube

© 2023 CrowdStrike All other marks contained herein are the property of their respective owners.

Enter search term