Live Terminal enables security teams to establish real-time interactive shell sessions with endpoints for investigation, forensic analysis, and remediation activities.
| Permission | Description | Roles Example |
| ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| None | No access to Live Terminal | <p>SOC Tier-1 Analyst: Initial triage role - should not have direct endpoint shell access. Risk of accidental damage or evidence tampering. Requires advanced skills they may not have</p><p>.</p> |
| View/Edit | <p>Full access to the Live Terminal <strong>Investigation & Response</strong> → <strong>Response</strong> → <strong>Live Terminal</strong>, and to start a Live Terminal in all menus such as Casuality View, Asset View, Case View, and Broker VM. Users can do the following:</p><ul><li>Initiate terminal sessions</li><li>File Explorer (browse, upload, download, delete files)</li><li>Task Manager (view, terminate processes)</li><li>Command Line (CMD, PowerShell, Python)</li><li>All terminal capabilities</li></ul> | <ul><li>SOC Tier 2 and 3 Analysts: Perform deeper investigation needing direct endpoint access for evidence collection, process analysis, and targeted remediation.</li><li>Threat Hunter: Needs direct endpoint access to investigate suspicious activity, collect artifacts, analyze processes, and validate threat hypotheses. Core hunting tool.</li><li>Security Engineer: Troubleshoots agent issues, tests endpoint configurations, validates security controls, and supports complex case response.</li></ul> |
**Required and recommended permissions**
Response actions require deep integration with the core platform to locate endpoints, track containment history, and link actions back to the active case. Consider adding the following permissions:
| Permission | Permission Level | Reason |
| ----------------------------- | -------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Agent Management | View | Live Terminal is initiated from the Agent Management context menu. Without this, users have no way to browse and select endpoints. Required. |
| Live Terminal (Action Center) | View | Live Terminal actions are logged in the Action Center. Users need visibility into their session history and results. Recommended |
| Cases & Issues | View | Actions link directly to cases. Access is required to initiate response actions directly from the Causality View or Issue View context menus. Recommended. |
| Scripts | Enabled with checkboxes selected | Enabled with **Scripts** and **Create Scripts** selected. Required for the Action Center's Scripts tab to be visible, and required to execute items from the Agent Script Library. |
| Query Center | View | Recommended to view File Search results, investigate script executions, or add indicators to blocklists directly from XQL results. |
| Forensics | View | Complementary investigation tool. Forensic Timeline and Event Log Search provides context for Live Terminal activities. Recommended |
| Host Insights | View | Recommended to access the IOC Rules page to block indicators or evaluate hash exceptions. |