Skip to content

Security and Exposure

Security & Exposure shows where content is over-exposed, answers who can see a folder and which folders a user or group can see, and lists account hygiene problems.

Image of the Security & Exposure page with the banner, Exposure tiles, Who can see, Account hygiene and Authentication mix

../../images/web-console/insights/security-full.png

What it answers

  • On how many folders does Everyone have Full Control, or at least view rights?
  • Which principals hold explicit Full Control besides Administrators and Everyone?
  • How many documents, schedules and instances store a database password?
  • Who changed rights recently, and where is folder inheritance switched off?
  • Who can view this folder? Which folders can this user or group view?
  • Which accounts are disabled but still own content, never logged on, dormant, or in no group?

Open it

In the BusinessObjects console, select Insights > Security & Exposure.

Filters

Filter Values Effect
Environments one button per environment Limits every panel.
Window 30d, 90d, 180d, 365d (default 90) Window for the rights-change count.
People + service accounts / People only toggle Shown on every Insights page; Who can see always flags service accounts in its results.
Who can see search folder name or path; user or group name (2+ characters) Picks the folder or principal to resolve.
Access chips (All, Can view, Unknown, Denied, No view right) one per Who can see panel Filters the resolved list.

How access is calculated

MetaMiner captures role-based access levels on folders, categories, universes and connections, with folder inheritance as BusinessObjects resolves it, at each scheduled security pull. Advanced (granular) rights and explicit denies set through advanced rights are not captured. A banner at the top states how many folder entries carry advanced rights only (their effect is unknown) and when security was last captured per environment.

Every user-level answer on this page is therefore a role-based estimate. Entries with unknown rights are counted and shown, never treated as zero.

Panels

Panel What it shows Source
Everyone has Full Control Folders where Everyone has Full Control (explicit or inherited), per environment. Excludes Full Control (Owner). Security entries
Everyone can view Folders Everyone can view (a lower bound), plus folders where Everyone's rights are unknown. Security entries
Explicit Full Control Principals other than Administrators and Everyone with explicit Full Control on folders; folders affected; grants made to users directly; Administrators membership. Security entries, groups
Stored DB credentials Documents, schedules and instances that hold a saved database password. Counted only; the password is never read. CMS metadata
Rights changes, N d Rights Modification and Custom Access Level events in audit. Unknown without audit data. Audit data
Inheritance breaks Folders where "inherit from parent folder" is off for a principal. Security entries
Rights changed after capture Objects whose audited rights change is newer than the captured security; the stored entries may predate the change. Audit data, security entries
Who can see Two panels: Folder -> who can view it (users with access, granted via, other entries, unknown entries, enabled, service) and User or group -> folders it can view (folder, access, granted via, explicit, inheritance off). Print / PDF prints the result. Security entries, groups, nested groups
Account hygiene Tiles: Disabled, still in groups; Disabled, owning content; Disabled, owning recurring schedules; Enabled, never logged on; Enabled, dormant > 180 days; Users with several aliases; Mixed authentication; No Enterprise alias; Users in no group; Empty groups. Click a tile for the accounts. User accounts, groups
Authentication mix Users per authentication type and environment. Click a bar to list the aliases in System Info. User aliases
Not on this page Explains what is not captured and links to Job Floor (external e-mail) and System Info (every folder security entry). -

Tiles that lead to long lists (Everyone, Full Control, inheritance, hygiene) open the matching listing in System Information for paging and export.

Image of the Exposure tiles with the Stored DB credentials list expanded below

../../images/web-console/insights/security-exposure.png

Image of the Who can see section with a folder resolved on the left and a group resolved on the right

../../images/web-console/insights/security-who-can-see.png

Image of the Account hygiene tiles with one tile selected and its account list

../../images/web-console/insights/security-hygiene.png

Export

Export the Who can see results and drill-down lists with Excel or CSV, or copy the SQL. See Insights Dashboards.