<commit_before>---
title: Metrics Security Policy Rules
keywords: administration
tags: [administration]
sidebar: doc_sidebar
permalink: metrics_security.html
summary: Use metrics security to control access to time series, histograms, and delta counters.
---

In a large enterprise, certain data are confidential. Wavefront allows you to limit who can see or modify data in several ways.
* **Permissions** are **global** settings.
  - Some permissions limit who can modify Wavefront objects (e.g. proxies or events). For example, users with **Dashboards** permission can modify all dashboards.
  -  Other permissions make certain information completely invisible. For example, only users with **SAML IdP Admin** permission can see the **Self Service SAML** menu or access that page.
* **Access Control** allows administrators with the right permissions fine-grained control over individual dashboards or alerts. For example, it's possible to limit view and modify access to a Finance_2020 dashboard to just the Finance department.
* **Metrics Security** supports even finer-grained control. In the example above, access to the Finance_2020 dashboard is limited to the Finance department. With metrics security, you can limit access to confidential time series, histogram, and delta counter metrics to the leadership team.

{% include note.html content="Only a Super Admin user or users with **Metrics** permission can view, create, and manage metrics security policy. " %}

## Video: Metrics Security Policy

Watch this video for an overview.

<p>
<iframe src="https://bcove.video/2JgVcXq" width="700" height="400" allowfullscreen="true" alt="Metrics Security Policy video"></iframe>
</p>

## How Metrics Security Protects Sensitive Data

Metrics security policy rules allows fine-grained support for limiting access to sensitive data.

### Block or Allow Access

With a metrics security policy, you can block or allow access:
* To metrics, optionally filtered by source or point tag
* Based on groups, roles, and individual users.

When an account attempts to access metrics, the backend looks at the rules in priority order. Higher priority rules overwrite lower priority rules.

For example, assume you have two rules:

<table style="width: 100%;"><commit_msg>Metrics security only available on selected WF instances.<commit_after>---
title: Metrics Security Policy Rules
keywords: administration
tags: [administration]
sidebar: doc_sidebar
permalink: metrics_security.html
summary: Use metrics security to control access to time series, histograms, and delta counters.
---

In a large enterprise, certain data are confidential. Wavefront allows you to limit who can see or modify data in several ways.
* **Permissions** are **global** settings.
  - Some permissions limit who can modify Wavefront objects (e.g. proxies or events). For example, users with **Dashboards** permission can modify all dashboards.
  -  Other permissions make certain information completely invisible. For example, only users with **SAML IdP Admin** permission can see the **Self Service SAML** menu or access that page.
* **Access Control** allows administrators with the right permissions fine-grained control over individual dashboards or alerts. For example, it's possible to limit view and modify access to a Finance_2020 dashboard to just the Finance department.
* **Metrics Security** supports even finer-grained control. In the example above, access to the Finance_2020 dashboard is limited to the Finance department. With metrics security, you can limit access to confidential time series, histogram, and delta counter metrics to the leadership team.

{% include important.html content="This feature is not available on all Wavefront instances." %}

{% include note.html content="Only a Super Admin user or users with **Metrics** permission can view, create, and manage metrics security policy. " %}

## Video: Metrics Security Policy

Watch this video for an overview.

<p>
<iframe src="https://bcove.video/2JgVcXq" width="700" height="400" allowfullscreen="true" alt="Metrics Security Policy video"></iframe>
</p>

## How Metrics Security Protects Sensitive Data

Metrics security policy rules allows fine-grained support for limiting access to sensitive data.

### Block or Allow Access

With a metrics security policy, you can block or allow access:
* To metrics, optionally filtered by source or point tag
* Based on groups, roles, and individual users.

When an account attempts to access metrics, the backend looks at the rules in priority order. Higher priority rules overwrite lower priority rules.

For example, assume you have two rules:

<table style="width: 100%;">
{'fraction_non_alphanumeric': 0.06986712387483926, 'fraction_numerical': 0.007715387912558937, 'mean_word_length': 5.068920676202861, 'pattern_counts': {'":': 0, '<': 13, '<?xml version=': 0, '>': 13, 'https://': 2, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '5369714', 'n_tokens_mistral': 1146, 'n_tokens_neox': 1068, 'n_words': 621}