Detection Rules permissions ↗

Detection Rules permissions

You can limit permissions for Detection rules (Threat Management → Detection Rules), which include the following:

  • IOC Rules: Indicator of Compromise rules that detect known malicious artifacts such as file hashes, IP addresses, domains, and URLs based on threat intelligence feeds.
  • BIOC rules: Behavioral Indicator of Compromise rules that detect suspicious activity patterns using XQL queries to identify threats based on behavior rather than static indicators.
  • Analytic rules: Machine learning and statistical analysis rules that detect anomalies and threats using the Analytics Engine for advanced behavioral detection.
  • Correlations: Correlation rules that combine multiple events or conditions to detect complex attack patterns spanning multiple data sources or time periods.
  • Indicator rules: Rules that automatically create IOC detection or prevention rules based on threat intelligence indicators matching specific criteria.

Caution

Users must have View/Edit access to the Query Center if they are expected to create or edit BIOC and Correlation rules.

Component Description Roles Example
None No access to Detection Rules.  
View Read-only access to Indicator rules, IOC, BIOC, Correlations, and Exceptions pages. SOC Tier-1 analysts: Understand what rules are triggering issues.
View/Edit <p>Full access to Detection rules, including creating, editing, deleting, and enabling rules.</p><p>When Rules is set to View/Edit, you can grant the following additional permissions:</p><ul><li>Prevention Rules: Blocks or stops suspicious or malicious processes on an endpoint.</li><li>Request WildFire Verdict Change: Report a file’s WildFire verdict as incorrect and suggest a corrected classification.</li></ul> <ul><li>SOC Tier 2 Analyst: Investigate cases and may need to create or modify detection rules based on findings. Should not manage prevention rules or request WildFire Verdict Change.</li><li>SOC Tier-3 Analyst: Handles complex incidents and has the authority to manage prevention rules and request WildFire Verdict Change.</li><li>Threat Hunter: Proactive threat detection specialists who search for hidden threats and create detection rules based on hunting findings. Should not manage prevention rules, but can Request WildFire Verdict Change.</li><li>Security Engineer: Full access to build and optimize detection/prevention capabilities, including WildFire verdict change requests.</li></ul>

Required and recommended permissions

Consider adding the following permissions:

Permission Permission Level Reason
Query Center View/Edit Required to edit BIOC and Correlation Rules.
Cases & Issues View Strongly recommended. Detection rules generate issues that appear in Cases & Issues. Without case access, analysts cannot see the issues triggered by the rules they are viewing, losing critical context for rule effectiveness assessment.
Threat Intelligence View <p>Strongly recommended for Threat Intelligence (TIM). IOC rules are based on threat intelligence indicators. Without Threat Intelligence view, users cannot see the indicators that IOC rules are matching against, making rule review incomplete.

Required for Extended Threat Intelligence (XTI). Indicator rules are based on XTI indicators. Without Threat Intelligence view, users cannot use the indicators that indicator rules are matching against.</p>
Policies View Recommended. Prevention rules are assigned to policies. Viewing policies helps understand which rules are actively enforced on endpoints and their scope.
Global Exceptions View Recommended. Global Exceptions View provides visibility into exception rules that may suppress detection rule issues.