Data Management permissions

Control access to Cortex AgentiX dataset configuration and data lifecycle management.

Controls access to dataset configuration, data transformation rules, and data lifecycle management in Cortex AgentiX through Settings → Configurations → Data Management. This permission includes:

• Dataset Management: For viewing and managing datasets
• Event Forwarding: For sending data to external systems

Caution

This permission only offers None or View/Edit access. While SOC Tier-2, Tier-3, and Threat Hunters may need to view data schemas for advanced investigations, granting them View/Edit access gives them full control to modify datasets, and change ingestion pipelines. Grant this permission with caution and ensure proper change management protocols are in place.

Permission	Description	Roles Example
None	Users cannot access any Data Management configuration pages.	SOC Tier-1 Analyst: Data management configuration is outside Tier-1 responsibilities.
View/Edit	Full control over creating/managing datasets, and configuring advanced ingestion pipelines.	SOC Tier-2 and 3 Analysts: May need to understand data schemas during investigations/advanced analysis. Threat Hunter: May need to understand data schemas and transformations for hunting. Security Engineer: Primary responsibility for configuring data pipelines and transformations.

Required and recommended permissions

Consider adding the following permissions:

Permission	Permission Level	Permissions
Public APIs	View/Edit	Compute Unit Usage page access; without this, the Compute Unit Usage page is inaccessible. Required.
Query Center	View/Edit	Running XQL queries against managed datasets. Strongly recommended.
Data Sources	View/Edit	Understanding which data sources feed into managed datasets. Recommended.