Documentation

Groups

Create and manage permission groups that control what users can see and do.

Overview

Groups let you bundle permissions together and assign them to users. Instead of granting permissions to each user individually, you create a group with the right set of permissions, then add users to that group. Every user in the group inherits the group’s permissions.

Use this page to:

View all existing groups, their members, and their permissions.
Create a new group with a name, users, and permissions.
Edit or delete an existing group.
Enable or disable a group without deleting it.

How to Open This Page

Click Administration in the top navigation bar.
Click the Groups tab in the strip of administration sections at the top of the page.

You can also open the page directly at /administration/groups.

You need the Users / Groups permission to access this page. If you do not see the Groups tab, ask an administrator to add your account to a group that includes this permission.

Main Areas

1 Administration tabs - switch between the administration sections. The active section (Groups) is highlighted.
2 Add group button - opens the form to create a new group.
3 Total counter - shows how many groups exist (for example, Total: 4 items).
4 Search field - filters the list by group name.
5 Groups list - one row per group, with the columns Name, Users, Permissions, Active, and Actions.

Groups List

Column	Description
Name	The group name, preceded by a question-mark help tip (see below).
Users	The usernames that belong to the group, one per line. Empty if the group has no members.
Permissions	The permissions granted to the group, one per line. Shows No access if the group has no permissions.
Active	A switch that enables or disables the group (not shown for the Administrators group).
Actions	The Edit group (pencil) and Delete group (trash can) buttons (not shown for the Administrators group).

The list shows 8 groups per page. When there are more groups, a pagination bar appears in the toolbar between the Add group button and the search field. Click a page number, or use the arrows, to move between pages.

Row Help Tips

Each group name has a small question-mark icon in front of it. Hover the icon (or move to it with the Tab key) to open a help bubble that explains the row:

For a regular group, the tip names the group, shows how many members it currently has, and reminds you that the Active switch enables or disables it, the pencil edits it, and the trash can deletes it.
For the Administrators group, the tip explains that it is a system group whose members have full access, and that it cannot be edited, deactivated, or deleted.

Searching

Type in the Search by group name… field to filter the list as you type. The search matches any part of the group name and is not case-sensitive. Click the × button next to the field to clear it. The search filters only the groups on the current page of the list.

The Administrators Group

The built-in Administrators group is special. It cannot be edited, deleted, or disabled: its Active and Actions columns are empty. This protects the system from accidentally removing all administrative access.

Creating a Group

Click the Add group button in the toolbar. A form titled Add Group opens.
Fill in the fields described below.
Click Save to create the group, or Close (or the × in the title bar) to discard.

Form Fields

Field	Required	Description
Name	Yes	A unique name for the group, between 4 and 255 characters. It cannot duplicate an existing group name.
Users	No	A multi-select list of all user accounts except Master admin accounts. Select one or more users to add them to the group.
Permissions	No	A multi-select list of all available permissions. Select the permissions every member of this group should receive.

Both lists support type-ahead search: start typing a username or permission name to narrow the list. The list stays open after each selection, so you can pick several entries in a row. Click the × on a selected entry to remove it, or the × at the right end of the field to clear the whole field. Press Esc to close an open list without closing the form.

Under the Permissions field, a short description explains what members of the group will be able to do with the current selection, so you can check the effect before saving. For example:

With no permissions selected: No access to Administration: members of this group won’t be able to view or modify anything there.
With View Settings selected: Members of this group will be able to view (but not modify) IP lists and settings under Administration.

If a field is not valid (for example, the name is too short or already taken), an error message appears in red under that field and the form stays open. Correct the value and click Save again.

On success, the form closes, a confirmation notification appears in the top-right corner, and the list refreshes. New groups are created active.

Available Permissions

Permission	What it controls
Modify Settings	Full (view and change) access to the Internal Networks, Allowlist, Blocklist, AI, Action Manager, DSS, and Retention Policies administration sections.
View Settings	Read-only access to the same administration sections as Modify Settings: members can open and review them but cannot add, change, or delete anything.
Users / Groups	Access to the Users and Groups administration sections.

A group can have any combination of permissions, or none at all. If a group has both Modify Settings and View Settings, Modify Settings applies. Users who belong only to groups with no permissions can still use the non-administration pages such as Stats, Actions, Notifications, and Attacks.

Editing a Group

Find the group in the list.
Click the Edit group button (pencil icon) in the Actions column. A form titled Edit Group opens, pre-filled with the group’s current name, users, and permissions.
Change the name, add or remove users, or add or remove permissions.
Click Save to apply the changes, or Close to cancel.

The same validation rules apply as when creating a group: the name must be 4–255 characters and unique (the group may keep its current name).

When you save, the group’s members and permissions are replaced with exactly what is selected in the form.

Deleting a Group

Find the group in the list.
Click the Delete group button (trash can icon) in the Actions column.
A confirmation dialog appears, titled Delete group “<name>”?, with the message This permanently removes the group and cannot be undone.
Click Yes, continue to delete the group, or Cancel to go back. Cancel is focused by default.

Deleting a group removes all of its user and permission associations. The users themselves are not deleted - they simply lose the permissions that came from that group.

This action cannot be undone.

Enabling and Disabling a Group

Each group row (except Administrators) has a switch in the Active column:

On - the group is active and its members receive its permissions.
Off - the group is disabled and its permissions are not granted to its members.

Click the switch to change the state. The change is saved immediately (there is no confirmation dialog). A small icon next to the switch shows the result:

Icon	Meaning
Spinner	The change is being saved.
Checkmark	The change was saved.
Exclamation mark	The change failed. Try again or check your connection.

Disabling a group is a way to temporarily revoke its permissions without deleting the group or removing its users.

Master Admin Protection

Master admin accounts (such as superadmin) receive their permissions from their groups, so the server refuses any group change that would take away a permission a Master admin account currently has. The change is not saved, and the error dialog names the permission(s) and the account:

Refused change	Error message
Editing a group (members or permissions)	This change would remove the “<permission>” permission from the Master admin account “<username>”. Master admin accounts must keep their access.
Deleting a group	Deleting the group “<group>” would remove the “<permission>” permission from the Master admin account “<username>”. Master admin accounts must keep their access.
Disabling a group	Deactivating the group “<group>” would remove the “<permission>” permission from the Master admin account “<username>”. Master admin accounts must keep their access.

A change is refused only when no other active group of the Master admin still grants the same permission. When several permissions would be lost, the message lists all of them (the “A”, “B” permissions).

Notes

Master admin accounts (such as superadmin) do not appear in the Users list when creating or editing a group, and the server refuses group changes that would take away their access (see Master Admin Protection).
A user can belong to multiple groups. Permissions from all of a user’s active groups are combined: if any one of them grants a permission, the user has that permission.
A user’s permissions are determined when the user signs in. Changes to a group’s permissions, members, or active state apply to an affected user the next time that user signs in.
The Groups page itself requires the Users / Groups permission. A user who cannot open this page cannot manage groups.

Users - manage individual user accounts, passwords, and account locking.
Administration - overview of all administration sections.