> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/asset-management/asset-roles/manage-asset-roles-for-endpoints.md). # Manage Asset Roles for Endpoints {% hint style="info" %} ### Note Endpoint Role Management is available only if the Identity Threat Module add-on is enabled. {% endhint %} The Edit Endpoint Role page enables you to edit the host lists assigned to asset roles. You may want to exclude some endpoints from certain asset roles even if Cortex XDR automatically detected the endpoint as having this asset role. For example, if an endpoint is reassigned to another user and you want their Analytics to be adjusted accordingly. The **Endpoints** list on the page displays the endpoints classified under the asset role, if the asset role was assigned automatically or edited manually for the endpoint, the last modification date, and the modifier. To access the **Edit Endpoint Role** page, from **Assets** → **Asset Role Configuration**, right-click to select the endpoint asset role and click **Edit Asset Role**. **Included Endpoints** displays all the endpoints Cortex XDR automatically detects as having this asset role and the endpoints you specify manually as having this asset role. **Excluded Endpoints** displays the endpoints that were manually removed from an asset role. When you exclude an endpoint, it remains in the **Excluded Endpoints** list and if detected automatically again in the future as having this role, will not be included in the role list. If you want to remove an endpoint from the list of endpoints with this asset role, right-click the endpoint and select **Exclude Endpoint**. The endpoint is then listed under **Excluded Endpoints** for this asset role. When you exclude an endpoint from an asset role, by default Cortex XDR also removes the endpoint from the parent asset roles of the current asset role. To remove the endpoint from the child asset role, but to leave it in any of its parent asset roles, click **Advanced Exclusion Settings**, and select **Don't Exclude** next to the name of the parent asset role(s). To include an **Excluded endpoint** back in the asset role, in the **Excluded Endpoints** list, right-click the endpoint and select **Delete Endpoint**. If the endpoint was automatically detected as having this asset role. it will be added back to the **Included Endpoints** list again. Otherwise, the next time Cortex XDR scans the assets and automatically detects their asset roles, this endpoint will be included in the asset role list. To include endpoints from your system manually in an asset role list, in the asset role page, click **Add Endpoint**. Select the endpoint from the displayed endpoint list, which displays the endpoints managed by the tenant. You can only add endpoints that have the Cortex XDR agent installed on them. Manually added endpoints are analyzed by Analytics when it runs next and are displayed in the **Incident view** and the **Host Risk view**. To delete a manually added endpoint from the Included Endpoints list, right-click and **Delete Endpoint**. {% hint style="info" %} ### Note Deleting a manually added endpoint removes the endpoint from the **Included Endpoints** list. If this endpoint is detected automatically as having this asset role in the future, it will appear in the **Included Endpoints** list. Excluding a manually added endpoint ensures that even if in the future the endpoint is detected as having this asset role, this detection is overridden and the endpoint isn't included in the asset role. {% endhint %} To change the name of an endpoint, right-click the endpoint name and **Edit Endpoint**. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/asset-management/asset-roles/manage-asset-roles-for-endpoints.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.