Role Capabilities

You can assign any of the following capabilities when you create roles.

Data Management

Capability	Description
Manage connections	Manage the connections that allow you to send alerts to other tools.
Manage Collectors	Install and manage and Installed/Hosted Collectors and Sources. Manage permission automatically includes view permission.
Manage Ingest Budgets	Manage ingest budgets. Enabling this will automatically enable the Manage Collectors capability. The Manage Collectors capability on its own permits the re-assignment of budgets to different Collectors, but not creating or deleting them.
Manage data volume feed	Enable and manage the data volume index for your account to avoid using On-Demand Capacity, and to determine when you need to upgrade your account.
View Collectors	View Collectors and Sources that have already been installed or added.
View fields	View fields, which are custom metadata fields you can assign to logs.
Manage fields	Manage fields, which are custom metadata fields you can assign to logs. Note that if you grant a role the Manage Fields capability, users with that role will also have the View Fields and View field extraction rules capabilities.
View field extraction rules	View field extraction rules, which speed the search process by automatically parsing fields as log messages are ingested.
Manage field extraction rules	Manage field extractions, which speed the search process by automatically parsing fields as log messages are ingested. Note that if you grant a role the Manage field extraction rules capability, users with that role will also have the Manage Fields, View Fields, and View field extraction rules capabilities.
View Partitions	View Partitions.
Manage Partitions	View, create, edit, and delete Partitions. Note that if you grant a role the Manage Partitions capability, users with that role will also have View Partitions and Manage S3 data forwarding capabilities.
View Scheduled Views	View Scheduled Views.
Manage Scheduled Views	View, create, edit, and delete Scheduled Views. Note that if you grant a role the Manage Schedule View capability, users with that role will also have View Scheduled View capabilities.
Manage S3 data forwarding	Manage S3 data forwarding from Sumo Logic to an S3 bucket.
Manage Content	Manage the content for your organization. This provides access to Admin Mode in the Library.
Manage Tokens	Manage Installation Tokens.
View Account Overview	View the Account Overview page.
View Parsers	View Parsers.
Download Search Results	Export log query results to a .csv file.

Metrics

Capability	Description
Manage Logs-to-Metrics	Create, edit, or delete Logs-to-Metrics rules.
Manage Metrics Transformation Rules	Create, edit, or delete Metrics Transformation rules.
Manage Metric Rules	Create, edit, or delete Metric Rules.

Security

Capability	Description
Manage password policy	Set the password policy for your Sumo Logic account.
Allowlist IP addresses	Explicitly grant access to specific IP addresses or address ranges.
Create access keys	Allows users to create their own access keys on the Preferences page.
Manage access keys	Set up, activate, deactivate, or delete access keys for your organization.
Manage support account access	Enable management of the Sumo Logic support account for your organization.
Manage audit data feed.	Enable and manage the Audit Index, which provides information on the internal events that occur in your account associated with account management, user activity, and scheduled searches.
Manage SAML	Provision and manage SAML for single sign-on to your Sumo Logic accounts.
Manage Share dashboards outside of the organization	Share a dashboard with users who don't have access to Sumo Logic.
Manage organization settings	Users with this capability can configure a concurrent user sessions limit and enable the Data Access Level for Shared Dashboards security policy.
Change Data Access Level	Users with this capability can change the data access level of dashboards or scheduled searches to which they have edit or manage permission.

Dashboards

Capability	Description
Share dashboards with the allowlist	Share dashboards in view-only mode with no login required. Viewers must be connecting from IP addresses specified in your service allowlist.
Share dashboards with the world	Share dashboards in view-only mode with no login required. Anyone with the URL can view the dashboard without logging in.

User Management

Capability	Description
Manage users and roles	Access the web app pages to manage users and roles.

Alerts

Folder-level permissions are available if your org has fine-grained Monitor permissions enabled. If you'd like to use this feature, contact Sumo Logic Support to have it enabled.

Capability	Description
View Monitors	View Monitors. If Monitor folder permissions are enabled for your org, users with this capability can view folders on the Monitors page to which they've been granted View access, and the Monitors contained in those folders.
Manage Monitors	A user with this capability can create new folders and Monitors, and grant other roles permissions to the folders they create. If Monitor folder permissions are enabled for your org, users with this capability can also create, edit, delete, update and grant permissions to folders to which another user has granted them those permissions.
View Alerts	View Alerts on the Alerts page.
Admin Monitors	If Monitor folder permissions are enabled for your org, users with this capability have full access (Create, Edit, Delete, Update, and grant permissions) to ALL folders and monitors on the Monitors page. This is similar to the Content Administrator capability of the Content Library.

Organizations

Capability	Description
View Organizations	View the Organizations UI.
Create Organizations	Create and provision child organizations.
Change Credits Allocation	Change the credits allocation for a child organization.
Create Trial Organizations	Create trial organizations. (For Sumo Logic Service Providers only.)
Upgrade Trial Organizations	Upgrade trial organizations. (For Sumo Logic Service Providers only.)
Deactivate Organizations	Deactivate trial organizations. (For Sumo Logic Service Providers only.)

Cloud SIEM Enterprise

Cloud SIEM Enterprise (CSE) capabilities only appear in the Roles UI if CSE has been enabled for your account.

Capability	Description
View Cloud SIEM Enterprise	Users with a role that grants this capability will see a "Cloud SIEM Enterprise" link in the left-nav bar of the Sumo Logic UI. When a user clicks on the link, the CSE Heads-Up Display (HUD) will open.
Comment on Insights	Add comments to Insights.
Create Insights	Create Insights.
Delete Insights	Delete Insights.
Invoke Insights Actions	Choose and run an Action from the Actions menu for an Insight.
Manage Insight Assignee	Change the user that is assigned to an Insights.
Manage Insight Signals	Add Signals to Insights; remove Signals from Insights.
Manage Insight Status	Change the status of an Insights.
Manage Insight Tags	Add and delete tags assigned to Insights.
View Rules	View CSE rules.
Manage Rules	Create, edit, and delete CSE rules.
View Threat Intelligence	View threat intel sources in CSE.
Manage Threat Intelligence	Create, edit, and delete threat intel sources.
View Match Lists	View Match Lists.
Manage Match Lists	Create, edit, and delete Match Lists.
View File Analysis	View file analysis (YARA) rules.
Manage File Analysis	Create, edit, and delete file analysis (YARA) rules.
View Custom Insights	View custom Insight configurations.
Manage Custom Insights	Create, edit, and delete custom Insight configurations.
View Network Blocks	View network blocks.
Manage Network Blocks	Create, edit, and delete network blocks.
View Suppressed Entities	View Suppressed Entities.
Manage Suppressed Entities	Suppress and unsuppress Entities.
View Mappings	View log mappings and ingest mappings.
Manage Mappings	Create, edit, and delete log mappings and ingest mappings.
View Workflow	View Insight detection settings, custom Insight statuses and resolutions, and tag schemas.
Manage Workflow	Create, edit, and delete Insight detection settings, custom Insight statuses and resolutions, and tag schemas.
View Context Actions	View Context Actions.
Manage Context Actions	Create, edit, and delete Context Actions.
Manage Actions	View, create, edit, and delete Actions.
View Enrichments	View Enrichments.
Manage Enrichments	Upload Insight, Signal, and Entity enrichments using the CSE API.
View Custom Entity Types	View custom Entity types.
Manage Custom Entity Types	Create, edit, and delete custom Entity types.
View Entity Normalization	View the configurations on CSE’s Domain Normalization page.
Manage Entity Normalization	Update the configurations on CSE’s Domain Normalization page.
View Entity Criticality	View Entity Criticalities.
Manage Entity Criticality	Create, edit, and delete Entity Criticalities.
View Tag Schemas	View tag schemas.
Manage Tag Schemas	Create, edit, and delete schema key tags, which can be attached to Insights, Signals, Entities, and Rules.
Manage Favorite Fields	Add and remove favorite fields by clicking the star icon next to the fields in CSE Records.
View Entity Groups	View Entity Groups.
Manage Entity Groups	Create, edit, and delete Entity Groups.