Enables the configuration and management of cloud and third-party data source integrations. This includes Cloud Service Provider (CSP) integrations (AWS, Azure, GCP), Cloud Workload Protection (CWP) instances, Cloud Access Security (CAS) connectors, and Outposts.
### Data Sources & Integrations page
Data Sources is managed under **Settings** → **Configurations** → **Data Collection** → **Data Sources & Integrations**. Access levels to the **Data Sources & Integrations** are determined with the Integrations permissions:
* Data Sources permission only: Users can view the page and manage cloud accounts (CSP), Cloud Workload Protection (CWP) instances, and Cloud Access Security (CAS) connectors.
* Integrations permission only: Users can view the page and manage data collection integration instances, specifically automation and feed integrations.
* Both permissions: Users have full visibility and can manage both data sources and integrations on the same page.
| Permission | Description | Roles Example |
| ---------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| None | Users cannot access the **Data Sources & Integrations** and **Outposts** pages. | SOC Tier-1 Analyst: Data source configuration is outside Tier-1 responsibilities. |
| View | Read-only access to view all configured instances, connection status, last sync times, and configuration details on the **Data Sources & Integrations** and **Outposts** pages. | <ul><li>SOC Tier-2 and 3 Analysts: May need to verify data source status/configurations during investigations.</li><li>Threat Hunter: May need to understand data sources for comprehensive threat hunting.</li></ul> |
| View/Edit | Full control over data source management. Users can add new sources via the wizard, modify settings (credentials, sync intervals), enable/disable sources, and manage associated content items. | Security Engineer: Primary responsibility for configuring and maintaining data sources. |
### Required and recommended permissions
Consider adding the following permissions:
| Permission | Permission Level | Reason |
| --------------------------------- | ---------------- | ----------------------------------------------------------------------------------------------------------------- |
| Integrations | View/Edit | Data Sources & Integrations is a shared page; need to manage integrations on the same page. Strongly recommended. |
| Marketplace | View/Edit | Browse and install new data source content packs from the Marketplace. Strongly recommended. |
| Log Collections | View | Managing XDR Collectors that may feed into data sources. Recommended. |
| Ingestion Monitoring (dashboards) | View | Viewing data ingestion dashboards. Recommended. |