TrueSight Automation Console provides role-based access to the application.
You access
Automation Console
based on the role assigned to you in the endpoint manager,
Server Automation
.
When you log in, the security group that you currently belong to appears in the top-right corner of the user interface. If you are assigned multiple roles in Server Automation, you can change the security group to view the application as per your defined role. For instructions about changing the security groups, seeLogging in – Changing the security group.
Based on their roles, users can perform these tasks for an efficient and automated patch management process:
| Permissions required in TrueSight Server Automation | |
|---|
Server Automation Administrator | - By default, the BLAdmins role in Server Automation has administrative permissions in the Automation Console. Users in the BLAdmins role have access to any entity (such as policies, operations, and catalogs) created by other administrative or non-administrative users.
- The BLAdmin user in Server Automation has administrative permissions to Automation Console.
| - Configure a service account to enable data refresh between Automation Console and Server Automation
and to obtain the change request status based on the data refresh cycle. - Manage security groups to provide role-based access to the application.
- Define Service Level Agreements that determine the period within which missing patches and vulnerabilities must be remediated.
- Import patch catalogs from Server Automation. These catalogs are used to create policies for scanning assets.
- Create exceptions for vulnerabilities or missing patches to exclude them from remediation.
|
Operator (Non-administrative Server Automation user) | - If using Authorization Profiles in Server Automation, users with roles that have access to the Manage Patching Job profile, with Roles.Read authorization have non-administrative access to the Automation Console.
- If not using Authorization Profiles, ensure that Server Automation roles have access to the following authorizations:
- BatchJob
- BLPackage
- DeployJob
- DepotGroup
- JobFolder
- JobGroup
- NSHScript
- PatchCatalog
- PatchingJob
- PatchSmartGroup
- Server
- ServerGroup
- Provide permissions to the assets or catalogs to be used by the operator.
To ensure that operators have access to artifacts created in Server Automation, and administrators in the BLAdmins role have permissions to update or delete those artifacts created by operators, do this: - Create an access control list (ACL) policy and assign BLAdmins permission to the policy.
- Create an ACL template using this policy.
- Assign the ACL template to the non-administrative or operator role.
For details, see ACL template - Template Access Control List in TrueSight Server Automation documentation.
| - Create patch policies that run according to a schedule to identify missing patches on assets.
- Import vulnerability scan files.
- Monitor the list of missing patches and identified vulnerabilities.
- Monitor assets with missing patches, vulnerabilities, and assets that are discovered in your environment but are not scanned for vulnerabilities.
- Create operations for installing missing patches or remediating vulnerabilities on assets.
- Monitor the Patch and Vulnerability dashboards to view the patch and vulnerability compliance on assets, and other metrics in your environment.
- View details of exceptions created for vulnerabilities or missing patches.
|