The Alarm Viewer lists alarms generated by LogRhythm, tracks alarm history, and updates alarm statuses.
Alarm Viewer Access Control
|
Access |
Global Admin |
Global Analyst |
Restricted Analyst |
|---|---|---|---|
|
Read |
All alarms, all associated events |
All alarms, all associated events |
It is possible for an Alarm to be associated with a Restricted Analyst (RA) and yet not allow the RA to see all associated events. This occurs when a Restricted Analyst has access to a Log Source for configuration purposes, but does not have access to the logs generated by the log source.
|
|
Update Status |
All |
All |
For associated Alarms |
|
Filter by Status |
Yes |
Yes |
Yes |
|
Filter by Alarm Rule |
Yes - all |
Yes - all |
Yes - all |
|
Filter by who was Notified |
Yes - all |
Yes - all |
No - The Restricted Analyst can only view alarms of which they were notified. |