> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/threat-management/identity-threat-module-itdr/asset-roles.md). # Manage user asset roles {% hint style="success" %} ### Prerequisites * ITDR add-on * **View** or **View/Edit** RBAC permissions for **Identity Runtime Security** {% endhint %} Cortex XSIAM continuously analyzes your users and automatically classifies them based on their activities under asset roles, for example, Domain Controller, Administrator, and Executive User. You can remove users from asset roles manually and override the automatically detected asset roles. You can edit, add, and fine-tune the assets associated with each asset role at any time. You can also import users using a CSV file. ​Fine-tuned asset roles aid the module in the following areas.​ * ​Enhancement of the accuracy of the analytics that runs on assets, enabling better detection of uncommon activities by the asset based on the baseline for the asset role. * ​Asset role visualization in the Incident view and the User view as background information for risk assessment. * ​Analysis of User peer groups for score trend comparison over selected timelines. ​To access the management page, navigate to **Inventory → Assets → Configurations → Asset Roles**. The asset roles configuration page displays the asset roles, their type, the number of assets that are associated with each asset role, and the last modification date. ### Edit user asset roles \ To edit a user asset role, filter for User, right-click the role and select **Edit Asset Role**. Note that some asset roles are nested under parent roles higher in the hierarchy. For example, an Admin User asset role may be a child asset role of the parent asset role Sensitive User. You can hover over the information icon next to a role's name to see its parent rule.\ Depending on the type of asset, you can manage the user asset role list. When editing an asset role, there are two primary lists:​ * ​**Included Users**: Displays all the users Cortex XSIAM automatically detects as having this asset role, as well as any users you have manually added. * ​**Excluded Users**: Displays the users that were manually removed from the asset role. #### User role actions ​ * **​Exclude a User**: In Included Users, right-click a user and select **Exclude User**. The user moves to the **Excluded Users** list, which overrides future automatic detections and ensures they are not added back to the role. By default, Cortex XSIAM also removes the user from the parent asset roles. * **​Advanced Exclusion Settings**: To remove a user from a child asset role but leave them in any parent asset roles, click **Advanced Exclusion Settings** and select **Don't Exclude** next to the name of the parent role. * ​**Manually Add Users:** Click **Add User** to manually assign a role. To add users one by one, click **Add New** and type the usernames using the exact `Netbios\samAccount` format. To add users in bulk, click **Import from File** and upload a structured CSV file. * **​Delete vs. Exclude**: If you right-click and select **Delete User** on a manually added user, the user is removed from the included list. If the system automatically detects the user acting in that role in the future, they appear in the Included User list again. To permanently prevent them from being associated with the role, you must use the **Exclude** action. * **Edit user name:** To change the name of a user, right-click the user name and **Edit User**. ## Honey user A honey user is a decoy account designed to mimic a legitimate user within your environment. This kind of user looks attractive to potential attackers, with access to many assets, and is used for triggering alerts if accessed. One of the techniques used by an attacker trying to gain access to your network is attempting to use the credentials of accounts in your organization. By setting up honey users, you can detect these access attempts as soon as they occur. Unlike genuine user accounts, honey users have no legitimate purpose within the organization, making any activity involving them inherently suspicious. Cortex XSIAM uses its out-of-the-box ITDR module to automatically detect activity on the honey user role for identifying suspicious activities. To use a honey user account for detection, you must configure it manually. **Configure a honey user** 1. In **Inventory** → **Assets** → **Configurations** → **Asset Roles,** right click to select **Honey User**. 2. Click **Edit Asset Role**. 3. Select **Add User** → **Add New** and enter the honey user account details in the NetBIOS\SAM Account format. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/threat-management/identity-threat-module-itdr/asset-roles.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.