Query Library permissions ↗
Controls access to the Query Library, which is a repository of saved XQL queries within Cortex XSIAM. It allows users to save, organize, share, and reuse XQL queries across the team. Key capabilities include:
- Browse, search, and filter saved queries by name, labels, and type
- Save new queries from XQL Search results
- Share queries with specific users or make them public
Users can primarily access Query Library from Investigation & Response → Search → XQL Search, and select the Query Library tab.
Note
Users must have at least View permission in Query Center to access the Query Library from Query Center.
If you want to execute and schedule queries from the Query Library, you also need View/Edit permission in the Query Center.
Cortex XSIAM enforces least-privileged per-object access by allowing you to manage access for individual instances of Saved Queries. For more information, see Manage access to objects.
| Permission | Description | Roles Example |
|---|---|---|
| Enabled | <p>Users can browse, search, filter, and view saved queries. Users can also save, edit, delete, and share their own queries. Users can also be granted:</p><ul><li>Create Queries: Users can edit, delete, and share queries.</li><li>Edit Public Queries: Adds the ability to edit and delete public/shared queries created by other users.</li></ul> | Most roles require creating/editing public queries. |
| Disabled | No access to the Query Library. |
Required and recommended permissions
| Permission | Permission Level | Reason |
|---|---|---|
| Query Center | View or View/Edit | <ul><li>View: The XQL Search page (where the Query Library lives) requires this permission. Without it, users cannot access the page. Required.</li><li>View/Edit. Required if users want to run and schedule queries.</li></ul> |
| Dataset Access | N/a | Required. Queries reference specific datasets. Without dataset access, queries will return errors or empty results. |
| Dashboards | Enabled | Strongly recommended for users to take a query from the Library and instantly turn it into a Dashboard widget for persistent monitoring. |
| Reports | Enabled | Recommended for users who need to link a Library query to a scheduled report (e.g., a weekly "Top 10 Blocked IPs" report). |