> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/forensic-investigations/manage-an-investigation/user-permissions.md).

# User permissions

By default, investigation permissions utilize the role-based access control (RBAC) settings configured in the system. Users must have a role with the Forensic permissions set to **View** in order to view forensic investigations. In order to create investigations or collections, a user must have a role where the Forensics permissions is set to **View/Edit**. Without either role, a user cannot interact with the forensics interface.

If Scope-Based Access Control (SBAC) is enabled on your system, from the **Permissions** table, you can select the users from which to assign permissions to the investigation.

Users with account administrator or instance administrator roles have access to investigations and can't be cleared from the **Permissions** table. They can view and edit all Investigations, including adding/removing users, creating/deleting collections, closing the Investigation. This prevents investigation lockout in the event of a user leaving before the Investigation is complete.

{% hint style="info" %}

### Note

Even if a user does not have access to view an investigation via the **Forensics Investigations** page, they can still query the results of the collections using an XQL query.
{% endhint %}

The **Permissions** fields describe the following information:

| Field       | Description                                                                                                                                                                                                                                           |
| ----------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| User Name   | Name of the user as logged in the **Settings**+Configurations → **Access Management** → **Users**.                                                                                                                                                    |
| Email       | The user's email as logged in the **Settings**+Configurations → **Access Management** → **Users**.                                                                                                                                                    |
| User Type   | Indicates whether the user was defined in Cortex XDR using the CSP (Customer Support Portal), SSO (single sign-on) using your organization’s IdP, or both CSP/SSO.                                                                                    |
| Role        | Name of the role assigned specifically to the user that is not inherited from somewhere else, such as a User Group. When the user does not have any Cortex XDR access permissions that are assigned specifically to them, the field displays No-Role. |
| Permissions | Options are None, View, View/Edit                                                                                                                                                                                                                     |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/detect-threats-and-analyze-data/forensic-investigations/manage-an-investigation/user-permissions.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.