Controls access to data collection integration instances, such as automation and feed integrations that collect and process data on the **Data Sources & Integrations** page (**Settings** → **Data Sources & Integrations**). It also controls access to classifiers and mappers **Settings** → **Configurations** → **Object Setup** → **Issues** → **Classification & Mapping**.
**Data Sources & Integrations page**
The Data Sources & Integrations page is a unified interface. Access levels are determined as follows:
* Data Sources permission only: Users can view the page and manage cloud accounts (CSP), Cloud Workload Protection (CWP) instances, and Cloud Access Security (CAS) connectors.
* Integrations permission only: Users can view the page and manage data collection integration instances, specifically automation and feed integrations.
* Both permissions: Users have full visibility and can manage both data sources and integrations on the same page.
There are two integration permissions:
* Integrations (under Data Collection): Configure data collection integrations
* Integration Permissions (under Integrations): Configure command permission for integrations.
| Permission | Description | Roles Example |
| ---------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| None | Users cannot view or configure any data collection integrations, including feed and automation integrations, on the Data Sources & Integrations page. | SOC Tier-1 Analyst: Integration configuration is outside Tier-1 responsibilities. |
| View | Read-only access to the Data Sources & Integrations page. Users can see integration instances, their status, configuration details, and associated classifiers/mappers. | <ul><li>SOC Tier 2 and 3 Analysts: Verify integration status during case response/advanced analysis.</li><li>Threat Hunter: May need to understand data collection sources for threat hunting.</li></ul> |
| View/Edit | <p>Full control over integration configurations. Users can create, modify, and delete integration instances, manage credentials, and configure classifiers and mappers for data ingestion.</p><p>Users can view the Credentials page, but cannot edit it without the Credentials View/Edit permission.</p> | Security Engineer: Primary responsibility for configuring integrations. |
**Required and recommended permissions**
Managing integrations effectively often requires visibility into overlapping functional areas. Consider adding the following permissions:
| Permission | Permission Level | Reason |
| --------------- | ---------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Data Sources | View/Edit | These are often used together on the Data Sources & Integrations page. Strongly recommended. |
| Marketplace | View/Edit | Strongly recommended. Necessary to install new integration content packs. Strongly recommended. |
| Log Collections | View/Edit | Strongly recommended. Log collection integrations that may be configured alongside data collection integrations. Strongly recommended. |
| Credentials | View/Edit | Strongly recommended for users who need full integration management capabilities, including credential lifecycle management (creation, rotation, deletion). |