Attack Surface Management (ASM) identifies exposed assets, misconfigurations, and vulnerabilities on your organization's external-facing attack surface. This permission covers the following:
* Attack Surface Rules: Detection rules that generate issues when specific external exposures are found (e.g., exposed RDP, insecure SSH).
* Vulnerability Testing: An active scanning module that performs non-intrusive and intrusive tests against discovered services to validate CVEs and exposures, generating CVSS/EPSS scores.
**Attack Surface Rules**
Attack Surface Rules permission controls access to:
* **Modules** → **Attack Surface** → **Policies** → **Attack Surface Rules**.
* **Modules** → **Attack Surface** → **Global Lookup**
* **Posture Management** → **Rules & Policies** → **Policies** → **Attack Surface Rules**
### Note
Requires an ASM, Exposure Management, or Cortex XSIAM Premium license.
If your organization does not have a Cortex XSIAM Premium license, users can only access Attack Surface features through the Modules menu. The Posture Management menu paths are not available.
| Permission | Description | Roles Example |
| ---------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| None | No access to the **Attack Surface Rules** and **Global Lookup** pages. | |
| View | <p>Read-only access to view all attack surface rules, their status, priority, and details.</p><p>The <strong>Global Lookup</strong> page is read-only.</p> | <ul><li>SOC Tier 1 and 2 Analysts: Needs visibility into exposures and vulnerabilities for initial triage; should not modify rules or policies.</li><li>Threat Hunter: Needs read access for threat research and correlation; typically does not modify rules or policies.</li></ul> |
| View/Edit | Full edit access to all view permissions, including enable/disable rules, update priority, and bulk-update policies. | <ul><li>SOC Tier 3 Analyst: Senior analysts who can tune attack surface rules.</li><li>Security Engineer: Configures and tunes attack surface rules.</li></ul> |
**Vulnerability Testing**
Vulnerability Testing permission controls access to:
* **Modules** → **Attack Surface** → **Policies** → **Attack Surface Tests**
* **Settings** → **Configurations** → **Attack Surface** → **Attack Surface Testing** → **Attack Surface Testing Configuration**.
### Note
Requires the Attack Surface Management or Cortex XSIAM Premium license.
| Permission | Description | Roles Example |
| ---------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| None | No access to the **Attack Surface Tests** and **Attack Surface Testing Configuration** pages. | |
| View | <p>The test results table is visible and read-only. Can view CVE details, CVSS scores, EPSS scores, and affected software.</p><p>Can see the <strong>Attack Surface Testing Configuration</strong> page from <strong>Settings</strong> → <strong>Configurations</strong> → <strong>Attack Surface</strong> → <strong>Attack Surface Testing</strong>.</p> | <ul><li>SOC Tier 1 and 2 Analysts: Needs visibility into exposures and vulnerabilities for initial triage; should not modify rules or policies.</li><li>Threat Hunter: Needs read access for threat research and correlation; typically does not modify rules or policies.</li></ul> |
| View/Edit | <p>Full access to the <strong>Attack Surface Tests</strong> page, including enable/disable tests, trigger manual scans.</p><p>Users have full access to the <strong>Attack Surface Testing Configuration</strong> page.</p> | <ul><li>SOC Tier 3 Analyst: Senior analysts who can tune attack surface testing.</li><li>Security Engineer: Configures and tunes attack surface testing.</li></ul> |
**Required and recommended permissions**
To effectively configure attack surface rules and active tests, administrators and analysts require deep visibility into the underlying asset inventory and the resulting security issues. Consider adding the following permissions:
| Permission | Permission Level | Reason |
| ------------------------ | ----------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Asset Management | View | Required for Attack Surface Rules and Vulnerability Management to access the asset inventory where tested services and rules reside. |
| Cases & Issues | View or View/Edit | <ul><li>View: Strongly recommended for Attack Surface Rules and Vulnerability Testing to view cases/issues generated from attack surface rules and vulnerability test findings.</li><li>View/Edit: Recommended for Attack Surface Rules and Vulnerability Testing if required to triage/respond to issues from attack surface rules/vulnerability test findings.</li></ul> |
| Attack Surface Rules | View | Strongly recommended for Vulnerability Testing. Provides visibility into the attack surface rules that define what is being tested. Helps users understand the context of vulnerability test results. |
| Vulnerability Testing | View | Strongly recommended for Attack Surface Rules. Provides visibility into vulnerability test results that are related to attack surface findings. Useful for understanding the full context of an exposure. |
| Vulnerability Management | View | Recommended for Vulnerability Management. Provides access to the broader vulnerability management dashboards where test findings are aggregated into vulnerability issues. Useful for understanding the full lifecycle of a finding. |