Fields and Types permissions ↗
Controls access to custom fields and indicator types within Object Setup Settings → Configurations → Object Setup:
- Case fields (Cases → Fields): Custom fields that extend the case data schema, appearing in case views, queries, and layouts.
- Issue fields (Issues → Fields): Custom fields for the issue data schema, often used for automation rules and filtering.
- Indicator fields and types: Definitions for custom indicator fields and new indicator types (e.g., Cloud Resource ID), including extraction regex patterns.
- SLA rules: Service Level Agreement rules that define time-based expectations for issue handling.
| Permission | Description | Roles Example |
|---|---|---|
| None | No access to define fields, types, or SLA rules. Users can still view and use existing fields in case/issue views, but cannot modify their definitions | SOC Tier 1 Analyst: Schema changes are outside Tier-1 scope; they use existing fields but don't need to see field configuration. |
| View | Read-only access to all field definitions, indicator types, and SLA rule configurations. Allows exporting definitions to CSV. | <ul><li>SOC Tier 2 and 3 Analysts: Need to understand field definitions for advanced queries, custom field usage, and investigation workflows.</li><li>Threat Hunter: Needs to understand field definitions for hunting queries (XQL) and custom field usage.</li></ul> |
| View/Edit | Full read/write access. Users can create, modify, or delete custom fields and indicator types, write extraction regex, and set SLA rules. |
Required and recommended permissions
As schema changes impact how data is displayed and analyzed, consider the following dependencies:
| Permission | Permission Level | Reasons |
|---|---|---|
| Cases & Issues | View | Required to see how fields are used in actual cases/issues. |
| Layouts | View | Strongly recommended. See how fields are rendered in layouts; needed to design layouts that use custom fields. |
| Case Properties | View | Strongly recommended. Understand incident structure (statuses, domains) alongside field definitions |
| Threat Intel | View | Recommended. Understand indicator types and fields in the context of threat intelligence. |
| Audit | View | Recommended to track field creation/modification history. |
| Marketplace | View | Recommended to install content packs that include field definitions and indicator types. |