# Security 

The monitoring module provides an additional set of restrictions and permissions
that can be used for access control. The following sections will list those
restrictions and permissions in detail:

## Permissions 

The monitoring module allows to send commands to an Icinga 2 instance.
A user needs specific permissions to be able to send those commands
when using the monitoring module.

Name                                             | Permits
-------------------------------------------------|-----------------------------------------------
monitoring/command/*                             | Allow all commands.
monitoring/command/schedule-check                | Allow scheduling host and service checks.
monitoring/command/schedule-check/active-only    | Allow scheduling host and service checks. (Only on objects with active checks enabled)
monitoring/command/acknowledge-problem           | Allow acknowledging host and service problems.
monitoring/command/remove-acknowledgement        | Allow removing problem acknowledgements.
monitoring/command/comment/*                     | Allow adding and deleting host and service comments.
monitoring/command/comment/add                   | Allow commenting on hosts and services.
monitoring/command/comment/delete                | Allow deleting host and service comments.
monitoring/command/downtime/*                    | Allow scheduling and deleting host and service downtimes.
monitoring/command/downtime/schedule             | Allow scheduling host and service downtimes.
monitoring/command/downtime/delete               | Allow deleting host and service downtimes.
monitoring/command/process-check-result          | Allow processing host and service check results.
monitoring/command/feature/instance              | Allow processing commands for toggling features on an instance-wide basis.
monitoring/command/feature/object/*              | Allow processing commands for toggling features on host and service objects.
monitoring/command/feature/object/active-checks  | Allow processing commands for toggling active checks on host and service objects.
monitoring/command/feature/object/passive-checks | Allow processing commands for toggling passive checks on host and service objects.
monitoring/command/feature/object/notifications  | Allow processing commands for toggling notifications on host and service objects.
monitoring/command/feature/object/event-handler  | Allow processing commands for toggling event handlers on host and service objects.
monitoring/command/feature/object/flap-detection | Allow processing commands for toggling flap detection on host and service objects.
monitoring/command/send-custom-notification      | Allow sending custom notifications for hosts and services.

## Restrictions 

The monitoring module allows filtering objects:

Keys                                        | Restricts
--------------------------------------------|-----------------------------------------------
monitoring/filter/objects                   | Applies a filter to all hosts and services.

This filter will affect all hosts and services. Furthermore, it will also
affect all related objects, like notifications, downtimes and events. If a
service is hidden, all notifications, downtimes on that service will be hidden too.

### Filter Column Names 

The following filter column names are available in filter expressions:

Column                                                     | Description
-----------------------------------------------------------|-----------------------------------------------
instance\_name                                             | Filter on an Icinga 2 instance.
host\_name                                                 | Filter on host object names.
hostgroup\_name                                            | Filter on hostgroup object names.
service\_description                                       | Filter on service object names.
servicegroup\_name                                         | Filter on servicegroup object names.
all custom variables prefixed with `_host_` or `_service_` | Filter on specified custom variables.
