Roles and what each can do
An organisation has three roles: administrator, analyst and read-only. livewells checks the role of the person on its server for each action.
| Action | Who can do it |
|---|---|
| Open a case and read its report | Administrators, analysts and read-only people |
| See Usage | Administrators, analysts and read-only people |
| Start a case from a link | Administrators and analysts |
| Upload a file | Administrators and analysts |
| Export a case or download a report | Administrators and analysts |
| Download a sample | Administrators and analysts |
| Delete a case | Administrators |
| Cancel a waiting run | Administrators |
| Make or revoke an API key | Administrators |
| Add, rotate or remove a webhook endpoint | Administrators |
| Change retention | Administrators |
| Switch sample downloads on or off | Administrators |
| Change the threat data setting or the hunt query setting | Administrators |
| Read and export the audit log | Administrators |
| Change roles, end sessions, remove and block people | Administrators |
| Change the sign-in rules | Administrators |
| Approve or revoke support access | Administrators |
| Change the start limit or the alert addresses | Administrators |
| Buy a top-up or open the billing portal | Administrators |
- The analyst who ran a case, or an administrator, can set its verdict and exclude it from threat data.
- A person with read-only access gets the answer
403with the codereader-read-onlyfor each action that changes data. - An organisation keeps at least one administrator. livewells refuses to remove or demote the last administrator.
- Entra gives the roles analyst and read-only. An administrator sets the administrator role in People. See Set up sign-in with Microsoft Entra.
See Administering livewells for each setting.