Jobs permissions ↗
Configure access to automation jobs. Jobs are scheduled playbook tasks that run at predefined intervals or in response to feed changes.
By default, the Jobs permission is set to None. While you can enable the Jobs permission itself, you will not be able to select playbooks to run within the job unless you have at least Viewer access to those playbooks. Additionally, viewing the results of a job within a case requires access to the Cases & Issues component.
| Permission | Description | Roles Example |
|---|---|---|
| View/Edit | Users can create, edit, enable/disable, and delete jobs. They can also manually trigger a job to Run now. | SOC Manager / Security Engineer: Needs full control over scheduling and operational tasks. |
| View | Users can view the list of all scheduled jobs, their status (Running, Error, etc.), and their next scheduled run time. | Compliance Auditor: Needs to verify that automated cleanup or reporting tasks are scheduled. |
| None | Cannot access the Jobs page or view any job configurations. | Standard User: Does not require access to backend automation scheduling. |
Required and recommended permissions
To work with jobs, an administrator must configure your user role with specific RBAC permissions.
| Component | Permission Level | Reason |
|---|---|---|
| Scripts (under Investigation & Response > Automations) | Enabled | Required to view and manage the underlying scripts used in automation workflows. |
| Playbooks (under Investigation & Response > Automations) | Enabled | Required to select and view the playbook logic that a job will execute. |
| Jobs (under Investigation & Response > Automations) | View or View/Edit | Enables access to the Jobs page to monitor or manage scheduled tasks. |
| Cases and Issues (under Cases & Issues) | View or View/Edit | Required to view the results (War Room/Work Plan) of jobs executed within an investigation container. |
Important considerations
- Visibility: For all users with View or Edit permissions, all Jobs are listed regardless of the user's object-level access to the specific Playbooks used in those jobs.
- System execution: Playbooks triggered by jobs run as "system". They are governed by the permissions of the involved integrations rather than the access context of the user who created the job.
- Execution results: To view the War Room or Work Plan for an investigation opened by a job, the user must have the Cases & Issues permission set to View or View/Edit (which in turn requires Playbooks and Scripts to be enabled).