Data Broker permissions ↗

Data Broker permissions control access to the Broker VM infrastructure.

Broker Service

Manages Broker VMs that act as intermediaries for data collection from various sources. Brokers can host applets and other collection services. Go to Settings → Configurations → Data Broker → Broker VMs.

For more information, see Manage Broker VM.

Caution

Pathfinder Applet and Pathfinder Data Collection permissions have been deprecated.

IT Admin Role: IT Admins require full View/Edit access as they are responsible for the VM infrastructure and network connectivity.

Permission Description Roles Example
None Cannot view or manage Broker VMs SOC Tier 1 and 2 Analysts: Infrastructure management is not part of analyst duties.
View Can view Broker VMs, their status, applet configurations, and clusters. <ul><li>SOC Tier 3 Analyst: May need visibility into data collection infrastructure.</li><li>Threat Hunter: May need to understand data collection sources,</li></ul>
View/Edit Can create, configure, and manage Broker VMs, applets, and clusters. Security Engineer: Responsible for data collection infrastructure and Broker management.

Managing Broker VMs effectively requires visibility into the data sources they collect from, the agents they interact with, and the infrastructure settings that govern them. Consider adding the following permissions:

Permission Permission Level Reason
Log Collections View Broker VMs are the primary infrastructure for log collection and need visibility into the collection status. Strongly recommended.
Data Sources View Understand data sources feeding through Broker VMs. Strongly recommended.
Agent Administrations View Brokers interact with agent infrastructure; agents connect through Brokers. Strongly recommended.
Auditing View Track changes to Broker configurations for compliance. Strongly recommended.
Cases & Issues View Broker issues may generate cases requiring investigation. Recommended.
Integrations View Brokers host integrations; need visibility into integration health. Recommended.
Alert Notifications View Syslog forwarding through Brokers is tied to notification configuration. Recommended.
Live Terminal View Remote terminal access to Broker VMs for troubleshooting. Recommended.
General Configuration View Server settings may affect Broker behavior. Recommended.
Query Center View Query Broker-related data for troubleshooting collection issues. Recommended.