Script permissions ↗

The Scripts permission is a foundational administrative and operational tool. In Cortex XSIAM, scripts (primarily Python-based) are the engine behind automated enrichment, complex data manipulation, and custom remediation actions.. For more information, see Scripts.

Caution

Scripts are a prerequisite for Playbooks. You cannot set Playbooks to Enabled unless Scripts is Enabled.

By enabling the Scripts component and selecting Create scripts that will run with super user, users gain unrestricted access to sensitive system resources. Because these scripts bypass standard security controls, this permission must be strictly limited to Security Engineers and Administrators.

Cortex XSIAM enforces least-privileged per-object access by allowing you to manage access for custom (user-defined) scripts. For more information, see Manage access to objects.

Component	Description	Roles Example
Enabled	<p>Can access the Scripts page, view script code and configurations, script execution results, and export script definitions.</p><p>Users can create, modify, and delete scripts depending on their per-object access and sub-permissions explained below. This can include the ability to import scripts from the Marketplace or upload custom Python code. This also allows a user to manually run a script from the CLI (War Room) or within a case.</p><p>When set to Enabled, you can grant the following additional permissions:</p><ul><li>Create Scripts: Enables all methods for adding scripts to Cortex XSIAM. This includes the New Script button, as well as the ability to Attach, Duplicate, or Detach scripts. The user who performs these actions is automatically designated as the Owner.</li><li>Edit Public Scripts: Allows the user to modify custom scripts set to Public, even if they are not the Owner.</li><li>Create scripts that will run with super user: Create scripts that will run with super user, which enables users to create scripts with elevated privileges, and users can mark scripts as high risk. Scripts that run with superuser can access all system resources. If unchecked, users can only create standard scripts.</li></ul><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p>Note</p><p>Users can also view and edit Lists (under Settings → Configurations → Object Setup → Lists) provided they have Cases & Issues permissions.</p></div>	<ul><li>SOC Tier 1, 2, and 3 Analysts and Threat Hunters: Should not do script editing, but need visibility into automation workflows.</li><li>Security Engineer: Security Engineers need full script capabilities for advanced development.</li></ul>
Disabled	<p>Cannot access the Scripts page, view any script configurations, see script execution results, or access any automation scripts in any context.</p><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p>Note</p><p>Scripts can only be Disabled after first setting Playbooks to Disabled and Playground to None.</p></div>

Required and recommended permissions

Consider adding the following permissions:

Permission	Permission Level	Reason
Playbooks	Enabled	Strongly recommended, as scripts are almost always the building blocks inside a playbook. To build an automated workflow, you need both.
Cases and Issues	View	Strongly recommended, as script execution results are tied to cases.
Action Center	View or View/Edit	<ul><li>View: Strongly recommended to view script execution history in the Action Center.</li><li>View/Edit: Strongly recommended, as many scripts trigger response actions (like Isolate); the Action Center tracks these executions.</li></ul>
Playground	View/Edit	View/Edit: Recommended to test scripts before deploying (especially Super User scripts).
Credentials	View	View: Recommended for scripts that require API keys or tokens to talk to external 3rd-party integrations (e.g., VirusTotal, ServiceNow).
Query Center	View	Recommended for scripts designed to pull and parse XQL data for custom reporting.