Detection Rules permissions

Configure Cortex AgentiX permissions for viewing and managing correlation and indicator detection rules.

You can limit permissions for Detection rules (Threat Management → Detection Rules), which include the following:

• Correlations: Correlation rules that combine multiple events or conditions to detect complex attack patterns spanning multiple data sources or time periods.

• Indicator rules: Rules that automatically create IOC detection or prevention rules based on threat intelligence indicators matching specific criteria.

Caution

Users must have View/Edit access to the Query Center to create or edit Correlation rules.

Component	Description	Roles Example
None	No access to Detection Rules.
View	Read-only access to the Correlations page.	SOC Tier-1 analysts: Understand what rules are triggering issues.
View/Edit	Full access to Detection rules, including creating, editing, deleting, and enabling rules.	SOC Tier 2 and 3 Analysts: Investigate cases and may need to create or modify detection rules based on findings. Threat Hunter: Proactive threat detection specialists who search for hidden threats and create detection rules based on hunting findings. Security Engineer: Full access to build and optimize detection capabilities.

Required and recommended permissions

Consider adding the following permissions:

Permission	Permission Level	Reason
Query Center	View/Edit	Required to edit Correlation Rules.
Cases & Issues	View	Strongly recommended. Detection rules generate issues that appear in Cases & Issues. Without case access, analysts cannot see the issues triggered by the rules they are viewing, losing critical context for rule effectiveness assessment.