The Agents Script Library in the Action Center (**Investigation & Response** → **Response** → **Action Center** → **Agent Script Library**) enables security teams to create, manage, and execute Python scripts on endpoints for response actions, forensic collection, and custom automation.
| Permission | Description | Roles Example |
| ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------- |
| None | No access to the Agent Script Library. Users cannot run scripts on endpoints, access script execution history, create, edit, or delete scripts. | |
| View | Users can access the Agent Script Library and view the script list, details, and code. Download the script code and definitions file and view the script history and results. | SOC Analyst Tier-1: Should have visibility into scripts and execution history, but no execution capabilities. |
| View/Edit | <p>When set to <strong>View/Edit</strong>, the following action checkboxes become available:</p><ul><li>Run Standard Script</li><li>Run High Risk Script</li><li>Script Configurations</li></ul> | SOC Tier 2 and 3 Analysts, Threat Hunters, and Security Engineers should have full access with granular controls. |
Agent Script Sub-permissions
| Sub-permission | Description | Roles Example |
| --------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------- |
| Run Standard Scripts | <p>Enables execution of standard scripts, which are lower-risk operations that don't make significant system changes, such as data collection, log retrieval, or read-only queries.</p><ul><li>Checked: Full access to run standard scripts in the Action Center (where the <strong>Outcome</strong> column is set to <strong>Standard</strong>), when defining an action (select <strong>Run Endpoint Script</strong>), Agent Management, and can rerun standard script executions and use interactive script mode for standard scripts.</li><li>Unchecked: Can view standard scripts in the Agent Script Library, but cannot execute standard scripts.</li></ul> | SOC Tier 2 and 3 Analysts, Security Engineers, Threat Hunters. |
| Run High-Risk Scripts | <p>Enables execution of scripts marked as High-Risk, which can make significant system changes, including file modifications, process termination, registry changes, or system configuration alterations. These scripts require elevated permissions due to their potential impact.</p><ul><li>Checked: Full access to run high-risk scripts in the Action Center (where the <strong>Outcome</strong> column is set to <strong>High-Risk</strong>), when defining an action (select <strong>Run Endpoint Script</strong>), Agent Management, and can rerun High-Risk script executions and use interactive script mode for standard scripts.</li><li>Unchecked: Can view high-risk scripts in the Agent Script Library, but cannot execute standard scripts.</li></ul><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Tip</strong></p><p>Consider adding Run Standard Scripts. High-risk scripts permission is typically granted alongside standard scripts.</p></div> | SOC Tier-3 Analysts, Security Engineers, and Threat Hunters. |
| Script Configurations | <p>Controls the ability to create, edit, clone, and delete scripts in the Agents Script Library. This is separate from the ability to run scripts.</p><ul><li><p>Checked: Full script management capabilities, including creating, editing, deleting, and saving a script</p><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>Only local scripts (created in the tenant) can be edited or deleted. Scripts from content packs can only be viewed or copied.</p></div></li><li>Unchecked: Can only view and download scripts.</li></ul> | Security Engineer |
**Required and recommended permissions**
Consider adding the following permissions:
| Permission | Permission Level | Reason |
| --------------------- | ---------------- | ------------------------------------------------------------------------------------------------------------------------ |
| Action Center | View | Without Action Center access, users cannot reach the Script Library page. Required. |
| Cases & Issues | View | Strongly recommended as the script execution results link to cases. |
| Agent Administrations | View | Required for endpoint selection for script execution. |
| Live Terminal | View | Often used together. Run scripts for data collection and then use Live Terminal for hands-on investigation. Recommended. |