> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/users-and-roles-management/roles-management/role-permissions-by-component/configuration-permissions/exclusion-list-permissions.md).
# Exclusion list permissions
Controls access to the indicator exclusion list configuration under **Settings** → **Configurations** → **Object Setup** → **Indicators** → **Exclusion List**. This governs the permanent exclusion of indicators such as IP addresses, domains, URLs, file hashes, and email addresses. It is primarily used for:
* Allowing known-good or trusted infrastructure.
* Suppressing false-positive indicators identified during investigations.
* Filtering noisy vendor feeds that generate high volumes of low-value alerts.
{% hint style="info" %}
### Note
When managing Indicators (located under **Threat Management** → **Threat Intelligence** → **Indicators**), users who lack View/Edit permissions for the Exclusion List will find that exclusion-related features (such as the **Exclusion reason** field and **Do not add to exclusion list** checkbox) are automatically hidden by the system.
{% endhint %}
| Permission | Description | Roles Example |
| ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| None | Users cannot view excluded indicators, add new ones, or perform imports/exports. | |
| View | Read-only access to the full table of excluded indicators, including values, types, and comments. Users can search, filter, and export the list. | SOC Tier-1 and 2 Analysts: Should be able to see what is excluded to understand why certain indicators are not flagged, but should not modify the list without approval. |
| View/Edit | Full read/write access. Users can manually add or remove indicators, perform bulk CSV imports/exports, and execute bulk operations. | - SOC Tier 3 Analyst: Can manage exclusions based on advanced threat analysis findings; trusted to add/remove indicators from the exclusion list.
- Threat Hunter: Critical for managing false positive indicators and tuning detection; threat hunters frequently need to exclude known-good indicators.
- Security Engineer: Manages exclusion lists as part of TI pipeline tuning and false positive reduction.
|
**Required and recommended permissions**
Consider adding the following permissions:
| Permission | Permission Level | Reasons |
| -------------- | ----------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Threat Intel | View or View/Edit | - View: Required to view indicators that may need exclusion; required to see the Indicators section.
- View/Edit: Strongly recommended to manage indicators alongside exclusions (delete, edit indicators).
|
| Cases & Issues | View | Understand the context of indicators being excluded (which issues they triggered). Strongly recommended. |
| Integrations | View | View TIM feed integrations that generate the indicators being excluded. Recommended. |
| Audit | View | Track who added/removed indicators from the exclusion list. Recommended. |
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/users-and-roles-management/roles-management/role-permissions-by-component/configuration-permissions/exclusion-list-permissions.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.