Exclusion List permissions ↗

Controls access to the indicator exclusion list configuration under Settings → Configurations → Object Setup → Indicators → Exclusion List. This governs the permanent exclusion of indicators such as IP addresses, domains, URLs, file hashes, and email addresses. It is primarily used for:

  • Allowing known-good or trusted infrastructure.
  • Suppressing false-positive indicators identified during investigations.
  • Filtering noisy vendor feeds that generate high volumes of low-value alerts.

Note

When managing Indicators (located under Threat Management → Threat Intelligence → Indicators), users who lack View/Edit permissions for the Exclusion List will find that exclusion-related features (such as the Exclusion reason field and Do not add to exclusion list checkbox) are automatically hidden by the system.

Access to the Indicators page itself requires a Threat Intelligence Management (TIM) add-on or a Cortex XSIAM Premium license.

Permission Description Roles Example
None Users cannot view excluded indicators, add new ones, or perform imports/exports.  
View Read-only access to the full table of excluded indicators, including values, types, and comments. Users can search, filter, and export the list. SOC Tier-1 and 2 Analysts: Should be able to see what is excluded to understand why certain indicators are not flagged, but should not modify the list without approval.
View/Edit Full read/write access. Users can manually add or remove indicators, perform bulk CSV imports/exports, and execute bulk operations. <ul><li>SOC Tier 3 Analyst: Can manage exclusions based on advanced threat analysis findings; trusted to add/remove indicators from the exclusion list.</li><li>Threat Hunter: Critical for managing false positive indicators and tuning detection; threat hunters frequently need to exclude known-good indicators.</li><li>Security Engineer: Manages exclusion lists as part of TI pipeline tuning and false positive reduction.</li></ul>

Consider adding the following permissions:

Permission Permission Level Reasons
Threat Intel View or View/Edit <ul><li>View: Required to view indicators that may need exclusion; required to see the Indicators section.</li><li>View/Edit: Strongly recommended to manage indicators alongside exclusions (delete, edit indicators).</li></ul>
Cases & Issues View Understand the context of indicators being excluded (which issues they triggered). Strongly recommended.
Integrations View View TIM feed integrations that generate the indicators being excluded. Recommended.
Audit View Track who added/removed indicators from the exclusion list. Recommended.