Live Terminal permissions ↗
Live Terminal enables security teams to establish real-time interactive shell sessions with endpoints for investigation, forensic analysis, and remediation activities.
| Permission | Description | Roles Example |
|---|---|---|
| None | No access to Live Terminal | <p>SOC Tier-1 Analyst: Initial triage role - should not have direct endpoint shell access. Risk of accidental damage or evidence tampering. Requires advanced skills they may not have</p><p>.</p> |
| View/Edit | <p>Full access to the Live Terminal Investigation & Response → Response → Live Terminal, and to start a Live Terminal in all menus such as Casuality View, Asset View, Case View, and Broker VM. Users can do the following:</p><ul><li>Initiate terminal sessions</li><li>File Explorer (browse, upload, download, delete files)</li><li>Task Manager (view, terminate processes)</li><li>Command Line (CMD, PowerShell, Python)</li><li>All terminal capabilities</li></ul> | <ul><li>SOC Tier 2 and 3 Analysts: Perform deeper investigation needing direct endpoint access for evidence collection, process analysis, and targeted remediation.</li><li>Threat Hunter: Needs direct endpoint access to investigate suspicious activity, collect artifacts, analyze processes, and validate threat hypotheses. Core hunting tool.</li><li>Security Engineer: Troubleshoots agent issues, tests endpoint configurations, validates security controls, and supports complex case response.</li></ul> |
Required and recommended permissions
Response actions require deep integration with the core platform to locate endpoints, track containment history, and link actions back to the active case. Consider adding the following permissions:
| Permission | Permission Level | Reason |
|---|---|---|
| Agent Management | View | Live Terminal is initiated from the Agent Management context menu. Without this, users have no way to browse and select endpoints. Required. |
| Live Terminal (Action Center) | View | Live Terminal actions are logged in the Action Center. Users need visibility into their session history and results. Recommended |
| Cases & Issues | View | Actions link directly to cases. Access is required to initiate response actions directly from the Causality View or Issue View context menus. Recommended. |
| Scripts | Enabled with checkboxes selected | Enabled with Scripts and Create Scripts selected. Required for the Action Center's Scripts tab to be visible, and required to execute items from the Agent Script Library. |
| Query Center | View | Recommended to view File Search results, investigate script executions, or add indicators to blocklists directly from XQL results. |
| Forensics | View | Complementary investigation tool. Forensic Timeline and Event Log Search provides context for Live Terminal activities. Recommended |
| Host Insights | View | Recommended to access the IOC Rules page to block indicators or evaluate hash exceptions. |