Add Tag-Based Access Control documentation and navigation entry (#752)
taylor_socfortress committed
Mar 6, 2026 at 15:36 UTC
bbe89e36787009d2219fee399317a462a780a960
3 files changed
+170
docs/docs.json
+6
@@ -115,6 +115,12 @@
115
"user/ui/indices-snapshots"
116
]
117
},
118
+ {
119
+ "group": "Access Control",
120
+ "pages": [
121
+ "user/ui/tag-access"
122
+ ]
123
+ },
124
{
125
"group": "Health (InfluxDB)",
126
"pages": [
docs/user/ui/tag-access.md
new
+163
@@ -0,0 +1,163 @@
1
+---
2
+title: Tag-Based Access Control (Tag RBAC)
3
+description: Restrict which alerts users and roles can see based on assigned tags.
4
+---
5
+
6
+# Tag-Based Access Control (Tag RBAC)
7
+
8
+**Menu:** Users → (select user) → Assign Tags | Settings → Tag RBAC Settings
9
+
10
+**Best for:** Admin
11
+
12
+Tag RBAC lets admins **restrict which alerts a user can see** based on the tags applied to those alerts. This is useful in multi-team or MSSP environments where different analysts should only see alerts relevant to their scope.
13
+
14
+---
15
+
16
+## How it works (mental model)
17
+
18
+1. Alerts in Incident Management can be **tagged** (e.g., `Network`, `Endpoint`, `O365`, `CustomerA`).
19
+2. An admin **assigns one or more tags** to a user (or role).
20
+3. When Tag RBAC is **enabled**, that user only sees alerts matching their assigned tags.
21
+
22
+```
23
+┌──────────────┐ ┌─────────────────┐
24
+│ Alert │ │ Analyst │
25
+│ tags: │ │ assigned tags: │
26
+│ [Network] │◄────────│ [Network] │ ✅ Can see
27
+│ [Endpoint] │ │ │
28
+└──────────────┘ └─────────────────┘
29
+
30
+┌──────────────┐ ┌─────────────────┐
31
+│ Alert │ │ Analyst │
32
+│ tags: │ │ assigned tags: │
33
+│ [O365] │ ✖ │ [Network] │ ❌ Cannot see
34
+└──────────────┘ └─────────────────┘
35
+```
36
+
37
+> **Key rule:** A user with **no tags assigned** has **no restrictions** — they can see all alerts. Tag RBAC only restricts visibility once you assign specific tags to a user.
38
+
39
+---
40
+
41
+## Access rules summary
42
+
43
+| User configuration | What they see |
44
+|---|---|
45
+| **No tags assigned** | All alerts (unrestricted) |
46
+| **Tags assigned** (e.g., `Network`, `Endpoint`) | Only alerts tagged with `Network` or `Endpoint` |
47
+| **Admin role** | Always full access regardless of tag assignments |
48
+| **Scheduler role** | Always full access regardless of tag assignments |
49
+
50
+---
51
+
52
+## Enabling Tag RBAC
53
+
54
+1. Navigate to **Settings → Tag RBAC Settings** (admin only).
55
+2. Toggle **Enable Tag RBAC** to **On**.
56
+3. Configure how **untagged alerts** should be handled (see below).
57
+4. Click **Save Settings**.
58
+
59
+> Until Tag RBAC is enabled, tag assignments on users have no effect — all users can see all alerts.
60
+
61
+---
62
+
63
+## Untagged alert behavior
64
+
65
+When Tag RBAC is enabled, you need to decide what happens to alerts that **don't have any tags**. There are three options:
66
+
67
+| Option | Behavior |
68
+|---|---|
69
+| **Visible to All** | Every user can see untagged alerts, regardless of their tag assignments. This is the safest default. |
70
+| **Admin Only** | Only admin users can see untagged alerts. Restricted users won't see them. |
71
+| **Default Tag** | Untagged alerts are treated as if they have a specific tag you choose. Users assigned that tag will see untagged alerts. |
72
+
73
+### When to use "Default Tag"
74
+
75
+This is useful when you want a catch-all group. For example:
76
+
77
+- Create a tag called `General` or `Triage`.
78
+- Set it as the default tag.
79
+- Assign `General` to your triage team.
80
+- Now untagged alerts land in their queue automatically without needing to tag every single alert.
81
+
82
+---
83
+
84
+## Assigning tags to users
85
+
86
+1. Navigate to the **Users** page.
87
+2. Select the user you want to configure.
88
+3. In the user detail panel, find the **Assign Tags** section.
89
+4. Use the multi-select dropdown to choose one or more tags.
90
+5. Click **Save**.
91
+
92
+To give a user unrestricted access again, clear all assigned tags (use **Clear All**) and save.
93
+
94
+> Tags must already exist in the system (created via alert tagging in Incident Management). You cannot create new tags from the assignment panel.
95
+
96
+---
97
+
98
+## Assigning tags to roles
99
+
100
+Instead of assigning tags per-user, you can assign tags at the **role** level. This is useful when all users with a particular role should have the same alert visibility.
101
+
102
+- **Role-level tags** apply to every user with that role.
103
+- **User-level tags** override or extend role-level tags for individual users.
104
+- If a user has both role-level and user-level tags, they see alerts matching **any** of their combined tags.
105
+
106
+---
107
+
108
+## Checking effective access
109
+
110
+You can verify what a user actually has access to by viewing their **effective access**, which combines:
111
+
112
+- Their role's tag assignments
113
+- Their personal tag assignments
114
+- Customer access restrictions (if applicable)
115
+
116
+This is helpful for troubleshooting when a user reports they can't see expected alerts.
117
+
118
+---
119
+
120
+## Common scenarios
121
+
122
+### MSSP with multiple customers
123
+
124
+| Tag | Assigned to |
125
+|---|---|
126
+| `CustomerA` | Analyst 1, Analyst 2 |
127
+| `CustomerB` | Analyst 3 |
128
+| `CustomerA`, `CustomerB` | Senior Analyst (sees both) |
129
+
130
+Each analyst only sees alerts tagged with their customer. The senior analyst sees both.
131
+
132
+### SOC with specialized teams
133
+
134
+| Tag | Assigned to |
135
+|---|---|
136
+| `Network` | Network team |
137
+| `Endpoint` | Endpoint team |
138
+| `O365` | Cloud team |
139
+
140
+Alerts are tagged by source, and each team only sees their relevant alerts.
141
+
142
+### Unrestricted senior staff
143
+
144
+Leave the tag assignment **empty** for senior analysts or SOC leads. They'll have full visibility across all alerts without restrictions.
145
+
146
+---
147
+
148
+## Troubleshooting
149
+
150
+| Symptom | Cause | Fix |
151
+|---|---|---|
152
+| User can't see any alerts | Tag RBAC is enabled but user has tags assigned and no alerts match | Verify the user's assigned tags match tags actually applied to alerts |
153
+| User sees all alerts despite having tags | Tag RBAC is not enabled | Enable Tag RBAC in Settings → Tag RBAC Settings |
154
+| Untagged alerts are invisible to analysts | Untagged alert behavior set to "Admin Only" | Change to "Visible to All" or "Default Tag" |
155
+| New alerts aren't visible to restricted user | New alerts aren't tagged yet | Tag the alerts, or set a default tag so untagged alerts route to the right users |
156
+
157
+---
158
+
159
+## Related pages
160
+
161
+- [Incident Alerts](./incident-alerts.md)
162
+- [Incident Cases](./incident-cases.md)
163
+- [Graylog Management (detections)](./graylog-management.md)
mkdocs.yml
+1
@@ -123,6 +123,7 @@ nav:
123
- Metrics: user/ui/graylog-metrics.md
124
- Pipelines: user/ui/graylog-pipelines.md
125
- Threshold Alerts: user/ui/alerts-graylog-threshold.md
126
+ - Tag-Based Access Control (Tag RBAC): user/ui/tag-access.md
127
- Connectors: user/ui/connectors.md
128
- External Services:
129
- External Services: user/ui/external-services.md