What type of actions can users perform if they are assigned the Real Time Responder - Read Only Analyst Role?

The role of a Real Time Responder - Read Only Analyst is specifically designed to allow users to observe and analyze data without the ability to execute commands that could alter the environment or system state. Therefore, users assigned this role can run read-only response commands, which are vital for assessment and analysis. This means they can access and review live data and telemetry, assess threat events, and gather intelligence through the platform’s interfaces without making changes or impacting ongoing operations.

This role is primarily focused on providing insights, allowing analysts to effectively monitor security incidents, visualize live system states, and gather information required for decision-making, all while maintaining system integrity by restricting the ability to carry out remediation or operational commands. Hence, it serves a critical purpose in incident response by enabling thorough investigation and oversight without the complications of execution permissions.