Restricted Macros

What are Restricted Macros?

Restricted macros are macros that could have serious detrimental changes on a remote system if misused or mistakenly used, for example, by executing an SQL query that includes a "CREATE" or "DELETE" command. This page details such macros and the security that exists to prevent misuse.

Important To Dos Before Using Restricted Macros

ReportMagic Administrators should:

Ensure that they set up Role Based Access Control as required to prevent regular users from making unwanted changes to input
Ensure they have set up Connection Role Security
Only select the Is Admin Locked check box on a Schedule when they are certain of their RBAC settings

What are Partially Restricted Macros?

As shown in the table below, macros are either always restricted or partially restricted.

A partially restricted macro is unrestricted in some cases (for example, an SQL-based macro using a SELECT statement), but restricted in others - for example, the same macro using a DELETE statement. A partially restricted macro is restricted when it contains SQL-like syntax which uses any of these commands:

ADD
ALTER
APPEND
BACKUP
CREATE
DELETE
DROP
EXEC
INSERT
TRUNCATE
UPDATE

List of Restricted and Partially Restricted Macros

Macro	Needs a Connection?	Partially or Fully Restricted??
`[Agent.Analysis:]`	Yes	Partially
`[Agent.Graph:]`	Yes	Partially
`[Agent.List:]`	Yes	Partially
`[Agent.SqlValue:]`	Yes	Partially
`[Agent.SqlValues:]`	Yes	Partially
`[Agent.Table:]`	Yes	Partially
`[Database.Graph:]`	Yes	Partially
`[Database.List:]`	Yes	Partially
`[Database.Table:]`	Yes	Partially
`[Database.Value:]`	Yes	Partially
`[Database.Values:]`	Yes	Partially
`[File.Copy:]` (from 3.11) Tip: if copying files to a SharePoint or SFTP, ensure write access is permitted>	No	Fully
`[File.CopyOutputFiles:]` (from 3.11) Tip: if copying files to a SharePoint or SFTP, ensure write access is permitted	No	Fully
`[LogicMonitor.CollectorExecute:]`	Yes	Fully
`[LogicMonitor.Query:]`	Yes	Fully
`[ServiceNow.Create:]`	Yes	Fully
`[ServiceNow.Delete:]`	Yes	Fully
`[ServiceNow.Update:]`	Yes	Fully
`[SolarWinds.List:]`	Yes	Partially
`[SolarWinds.Table:]`	Yes	Partially
`[Sql.Analysis:]`	Yes	Yes
`[Web.Query:]`	No	Fully

Who Can Run Restricted Macros?

In Report Studio

In Report Studio, only Admin users can run restricted macros.

Regular users can never run restricted macros in Report Studio.

In CRON-initiated Schedules

A Schedule containing restricted macros will run only when:

The Schedule is admin-locked (see Schedules)
Any Connection used by a restricted macro is writeable, NOT read-only (see Connections)

By clicking Run Now on a Schedule

Admin users can always click to run a Schedule containing restricted macros.

Regular users can run these click to run a Schedule containing restricted macros where:

The Schedule is admin-locked
Any Connection used by the macro is writeable, NOT read-only
The user has access to the required Connection because:

They have a Connection Role that permits Read access to the Connection OR
There are no Connection Roles associated with the Connection