Role-Based Access Control

Cortex XSIAM uses role-based access control (RBAC) to manage roles with specific permissions for controlling user access. This section provides reference information on role permissions by component.

Sub-topics

• Role permissions by component
• Core tenant and administrative permissions
• Configuration permissions
  • Auditing permissions
  • Alert Notifications permissions
  • General Configuration permissions
  • Cortex XDR Analytics permissions
  • Access management permissions
  • Data Broker permissions
  • Log Collection permissions
  • Data Sources permissions
  • External Issues Mapping permissions
  • Integrations - instance permissions
  • Integrations Permissions
  • Data Management permissions
  • Public API
  • Threat Intelligence permission - API configuration
  • Long-running HTTP Integrations configuration
  • Credentials permissions
  • Network Scanners permissions
  • Apps - Instance permissions
  • Object Setup permissions
    • Case Properties permissions
    • Exclusion List permissions
    • Fields and Types permissions
    • Layout permissions
    • Sync Profile permissions
• Marketplace permissions
• Help permissions
• SOC Operations, Investigation & Response permissions
• Dashboards and Reports permissions
  • Dashboards permissions
  • Command Center Dashboard permissions
  • Ingestion Monitoring dashboard permissions
  • Reports permissions
  • Email Command Center permissions
  • Cloud Security Command Center permissions
• Cases and Issues permissions
• Investigation and Response permissions
  • Search permissions
    • Query Library permissions
    • Query Center permissions
    • Forensics permissions
    • Host Insights permissions
    • Graph Search permissions
  • Response permissions
    • Action Center permissions
    • EDL permissions
    • Agent Scripts Library permissions
    • Live Terminal permissions
  • Automation permissions
    • Playbook permissions
    • Script permissions
    • Jobs permissions
    • Playground permissions
    • Automation Exclusion Center permissions
• Jupyter and Observability apps permissions
• Threat Management permissions
  • Detection Rules permissions
  • Threat Intelligence permissions
• Exceptions Configuration permissions
  • Issue Exclusions permissions
  • Exception Management Admin permissions
  • Exception Approver Admin permissions
• Managed Services permissions
• Cortex Agentic Assistant permissions
  • AI Prompts
  • Cortex Agentic Assistant Agents
• Agents and endpoint protection
• Inventory - Agent permissions
  • Agent Administrations
  • Agent Groups
  • Agent Prevention Policies
  • Global Exceptions
  • Agent Profiles
  • Agent Extension Policies
  • Agent Installations
  • Host Firewall
  • Device Control
• Data Security - Endpoint DLP permissions
  • Data-in-Motion Rules
  • Endpoint Applications
  • Endpoint Applications Groups
  • Endpoint DLP Settings
• Inventory - Assets permissions
  • Network Configuration permissions
  • Compliance (Legacy) permissions
  • Asset Inventory permissions
  • Asset Roles configuration permissions
  • Asset Groups permissions
• Exposure and Vulnerability Management permissions
  • Attack Surface permissions
  • Vulnerability Management permissions
  • Exposure Management permissions
• Cloud Security and Posture Management permissions
  • CLI Tool permissions
  • Application Security permissions
    • Application Security - Generic Collector permissions
    • Application Security - Issues permissions
    • Application Security - Scans permissions
    • Application Security - Policy Management permissions
    • Application Security - 3rd Party tools permissions
    • Configurations - Application Security permissions
  • Policies - Cloud Workload permissions
  • Cloud Security permissions
  • Compliance - Cloud permissions
  • Data Security permissions
  • AI Security permissions
  • Data Classification permissions
  • Identity Security permissions