Controls access to custom fields and indicator types within Object Setup **Settings** → **Configurations** → **Object Setup**:
* Case fields (**Cases** → **Fields**): Custom fields that extend the case data schema, appearing in case views, queries, and layouts.
* Issue fields (**Issues** → **Fields**): Custom fields for the issue data schema, often used for automation rules and filtering.
* Indicator fields and types: Definitions for custom indicator fields and new indicator types (e.g., Cloud Resource ID), including extraction regex patterns.
* SLA rules: Service Level Agreement rules that define time-based expectations for issue handling.
| Permission | Description | Roles Example |
| ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| None | No access to define fields, types, or SLA rules. Users can still view and use existing fields in case/issue views, but cannot modify their definitions | SOC Tier 1 Analyst: Schema changes are outside Tier-1 scope; they use existing fields but don't need to see field configuration. |
| View | Read-only access to all field definitions, indicator types, and SLA rule configurations. Allows exporting definitions to CSV. | <ul><li>SOC Tier 2 and 3 Analysts: Need to understand field definitions for advanced queries, custom field usage, and investigation workflows.</li><li>Threat Hunter: Needs to understand field definitions for hunting queries (XQL) and custom field usage.</li></ul> |
| View/Edit | Full read/write access. Users can create, modify, or delete custom fields and indicator types, write extraction regex, and set SLA rules. | |
### Required and recommended permissions
As schema changes impact how data is displayed and analyzed, consider the following dependencies:
| Permission | Permission Level | Reasons |
| --------------- | ---------------- | -------------------------------------------------------------------------------------------------------------- |
| Cases & Issues | View | Required to see how fields are used in actual cases/issues. |
| Layouts | View | Strongly recommended. See how fields are rendered in layouts; needed to design layouts that use custom fields. |
| Case Properties | View | Strongly recommended. Understand incident structure (statuses, domains) alongside field definitions |
| Threat Intel | View | Recommended. Understand indicator types and fields in the context of threat intelligence. |
| Audit | View | Recommended to track field creation/modification history. |
| Marketplace | View | Recommended to install content packs that include field definitions and indicator types. |