A security analyst at your organization needs access to the Falcon dashboard to view threat alerts and generate summary reports but must not be able to modify any system settings or policies. Which role should you assign to this user to meet these requirements?

The Read-Only Analyst role is specifically designed to grant view-only access to the Falcon platform. This role allows a user to see all data, including threat alerts, dashboards, and events, and to generate reports for situational awareness and analysis. Crucially, it prohibits any modifications, such as changing detection statuses, altering policies, or taking response actions on hosts. This aligns perfectly with the principle of least privilege for an analyst who only needs to monitor and report, ensuring they cannot inadvertently or intentionally change the security posture.

B. Admin: This role has full administrative privileges and can modify all system settings and policies, which is explicitly forbidden by the requirements.
C. Investigator: This role can perform response actions on hosts (e.g., network containment), which constitutes a modification capability beyond simple viewing and reporting.
D. Analyst: This role can manage detections (e.g., change their status or assign them), which is a form of modification not permitted by the scenario's requirements.

1. CrowdStrike Falcon Platform Documentation: In the "User Management" section, the documentation defines the built-in roles. The Read-Only Analyst role is described as having the ability to view all console data but lacking any permissions to create, modify, or delete configurations or take any response actions. This is contrasted with the Analyst, Investigator, and Admin roles, which are granted progressively greater modification and action privileges. (Reference: CrowdStrike Falcon® Platform Documentation, Host and Cloud Security > Users, Section: "Assigning Roles to Users").

2. University Courseware - Cybersecurity Operations: Curricula in advanced cybersecurity operations often use leading platforms like Falcon as case studies. Course materials explain that Role-Based Access Control (RBAC) is fundamental to security operations. A "read-only" or "auditor" role is a standard implementation of the principle of least privilege for personnel who require visibility without control, such as compliance officers or monitoring analysts. (Reference: Based on common curriculum structures in courses like SANS FOR508, which detail incident response toolsets and operational best practices).