Ransomware attackers specifically target and attempt to destroy backup systems to increase the probability of payment. Hardening your system is critical. Please ensure you have reviewed your platform security using the Security Hardening Checklist
Cohesity

COHESITY Documentation

Explore our documentation to get started, discover products & new features, access troubleshooting guides, register sources, platforms support.

Products
Data Security Alliance
Visit Cohesity.com
Demos
Support
Blogs
Developers
Partner Portals
Cohesity Community
© 2026 Cohesity, Inc. All Rights Reserved.
Terms of Use|
Privacy Policy|
Legal|
  1. Home
  3. NetBackup™ Web UI Security Administrator's Guide
  5. Managing role-based access control
  7. Add an object group
NetBackup™ Web UI Security Administrator's Guide

Add an object group

Object groups can define the assets, application servers, or protection plans that users can view or manage. You can create an object group that grant access to specific workloads or objects. For example, you can grant access to all objects in the VMware workload or to specific VMware servers. Or, you can grant access to all assets, application servers, or protection plans. For example, a backup administrator that has access for all protection plans can manage any protection plan in NetBackup.

To manage or perform recovery of assets or application servers, a user must have one or more access rules with an object group that includes those objects. To manage or subscribe assets to certain protection plans, a user must have one or more access rules with an object group that includes those plans.

Note:

Object groups can also limit what the user can create. For example, assume that a backup administrator has only one access rule that gives access to protection plans that contain the word "finance". Therefore that user can only create protection plans that contain the word "finance".

To add an object group

  1. On the left, click Security > RBAC.
  2. Click the Object groups tab and click Add.
  3. Provide the name and description for the object group.

    You may want to include any keywords that describe the type of assets in the group or the region the assets reside in.

  4. Select any assets that you want to add to this object group.

    You can define the assets for this object group in the following ways:

    • All assets in a specific workload

    • A specific VMware server and all its VMs

    • A specific VMware server and selected VMs for that server

    • Turn on Grant access to all to include all available assets

    See Selecting the assets for an object group.

    Users granted access to these assets can view or manage these assets, according to the role that they are assigned.

  5. Select any application servers that you want to add to this object group.

    You can define the application servers for this object group in the following ways:

    • All application servers, in a specific workload

    • Specific application servers

    • Turn on Grant access to all to include all available application servers

    See Selecting the application servers for an object group.

    Users granted access to these assets can view or manage these application servers, according to the role that they are assigned.

  6. Select the protection plans that you want to add to this object group.

    You can define the protection plans for this object group in the following ways:

    • Specific protection plans

    • Turn on Grant access to all to include all protection plans

    See Selecting the protection plans for an object group.

    Users granted access to these protection plans can view or manage these plans, according to the role that they are assigned. Users with "view" permissions can also subscribe assets to the protection plans in the object group.

  7. Click Save.
Selecting the assets for an object group

You can preview the assets that are included in an object group. See Preview the assets, application servers, or protection plans that are in an object group.

To include all assets in a specific workload

  • Click Add workload, then select the workload type that you want to include.

    For example, select VMware to include all VMware assets.

To include a specific VMware server and all its VMs

  1. Under Assets, click Add workload, then select the workload type that you want to include.

    For example, select VMware to include all VMware assets.

  2. Click Add VMware server.
  3. Select the name of the vCenter that you want to include. Or, click on the vCenter name to browse for a server, cluster, or datacenter.
  4. Click Save.

To include a specific VMware server and selected VMs for that server

  1. Under Assets, click Add workload, then select the workload type that you want to include.

    For example, select VMware to include all VMware assets.

  2. Click Add VMware server.
  3. Select the name of the vCenter that you want to include. Or, click on the vCenter name to browse for a server, cluster, or datacenter.
  4. Click Save.
  5. Turn off Include all VMs in this server.
  6. Define one or more conditions. Conditions are case-sensitive.

    For multiple conditions, select the operator (AND or OR).

    In the following example, the object group includes assets in the VMware workload, from the cluster servercl02 on the VMware server abc.domain.com and with a display name that starts with accounting.

Selecting the application servers for an object group

You can preview the assets that are included in an object group. See Preview the assets, application servers, or protection plans that are in an object group.

To include all application servers, in a specific workload

  • Under Application servers, click Add workload, then select the workload type that you want to include.

    For example, select VMware to include all VMware application servers.

To include specific application servers, in a specific workload

  1. Under Application servers, click Add workload, then select the workload type that you want to include.

    For example, select VMware to include all VMware application servers.

  2. Add one or more conditions. Conditions are case-sensitive.

    For multiple conditions, select the operator (AND or OR).

    In the following example, the object group includes application servers from the VMware workload with a server name that starts with HR or with a name that contains Marketing.

Selecting the protection plans for an object group

You can preview the assets that are included in an object group. See Preview the assets, application servers, or protection plans that are in an object group.

To include specific protection plans

  1. Under Protection plans, click Add condition.
  2. Select the attributes for the condition. Conditions are case-sensitive.

    For multiple conditions, select the operator (AND or OR).

    In the following example, the object group includes protection plans with a name that contains finance.

Preview the assets, application servers, or protection plans that are in an object group

You can preview the objects that are included in an object group. Note that an object group changes dynamically as objects are added and removed from the NetBackup environment. When backups run, the object group updates at run-time to reflect the objects available at the time of backup.

To preview the assets, application servers, or protection plans that are in an object group

  1. On the left, click Security > RBAC.
  2. Click the Object groups tab and the object group that you want to edit.
  3. To the right of Assets, Application Servers, or Protection Plans, click Preview.
  4. NetBackup displays a real-time view of the objects that meet the criteria that you configured. You can sort or search the objects in the preview. Note that searches are case-sensitive.
  5. When you are finished with the preview, at the top right-click the Close icon.

Feedback

Was this page helpful?
Previous

Edit or delete a custom role

Next

Previewing the assets, application servers, or protection plans for an object group

Feedback

Was this page helpful?