search

fleetdm / fleet

Open-source platform for IT, security, and infrastructure teams. (Linux, macOS, Chrome, Windows, cloud, data center)
https://fleetdm.com
Other
3.03k stars 422 forks source link

Create a "security team" read-only role in fleet that allows security to view all teams #16901

Open Patagonia121 opened 8 months ago

Patagonia121 commented 8 months ago

The use case here is that the user is a member of the security team (with a current role listed as "various") who's tasked with investigating all hosts across all teams when there's a critical CVE disclosed. In their current view, they can only interact with individual teams, but they'd like to have an "all teams" view to streamline their investigation work.

noahtalerman commented 8 months ago

Maybe the customer can create a shared account with the "Global observer" user role?

noahtalerman commented 7 months ago

Heads up @Patagonia121, this feature request was brought to feature fest on 2024-02-15 and wasn't prioritized for the current design sprint.

Please see the suggestion about creating a share account w/ the "Global observer" role.

Patagonia121 commented 6 months ago

@nonpunctual this is related to API array collection FYI

noahtalerman commented 5 months ago

this is related to API array collection FYI

@Patagonia121 when you get the chance, can you please add more context here? What API endpoint (s) are we talking about?

Thanks!

nonpunctual commented 5 months ago

@noahtalerman I think the technical part of this is that there are many API objects that require iterating.

Scripts is (was?) an example: to get "all scripts" programmatically I would need to get the array of scripts for each team, determine the length of the array & loop through all of them & create my own "master list." I think the endpoint the customer references here works the same way.

So, I think the expectation is that if I hit an API endpoint for some object in Fleet, the endpoint would "do the work" of collecting the entire set of those objects across all subsets instead of having to drill down into each subset to derive the whole set.

Thanks.