Investigator

Learn more about the Cortex XDR predefined user role called Investigator.

The base investigation role. Provides incident/alert triage (edit) with investigation tools (such as query center and Query Library (edit), but no response actions and no detection rule management, host insights, or configuration access.

Tip

Assign to SOC Tier-1 analysts who triage incoming issues, update incident status, and escalate to senior analysts. They can investigate using queries and view forensics data, but cannot isolate endpoints, run scripts, or modify detection rules.

To quickly see exactly which pages and actions a role allows, click on the role name, which opens a read-only view of all checked permissions. For more information about the permissions, see Role permissions by components.