Attack Surface permissions

Configure permissions for Attack Surface Management.

Attack Surface Management (ASM) identifies exposed assets, misconfigurations, and vulnerabilities on your organization's external-facing attack surface. This permission covers the following:

• Attack Surface Rules: Detection rules that generate issues when specific external exposures are found (e.g., exposed RDP, insecure SSH).
• Vulnerability Testing: An active scanning module that performs non-intrusive and intrusive tests against discovered services to validate CVEs and exposures, generating CVSS/EPSS scores.

Attack Surface Rules

Attack Surface Rules permission controls access to:

• Modules → Attack Surface → Policies → Attack Surface Rules.
• Posture Management → Rules & Policies → Policies → Attack Surface Rules

For more information, see Attack surface rules.

Permission	Description	Roles Example
None	No access to the Attack Surface Rules page.
View	Read-only access to view all attack surface rules, their status, priority, and details.	SOC Tier 1 and 2 Analysts: Needs visibility into exposures and vulnerabilities for initial triage; should not modify rules or policies. Threat Hunter: Needs read access for threat research and correlation; typically does not modify rules or policies.
View/Edit	Full edit access to all view permissions, including enable/disable rules, update priority, and bulk-update policies.	SOC Tier 3 Analyst: Senior analysts who can tune attack surface rules. Security Engineer: Configures and tunes attack surface rules.

Required and recommended permissions

To effectively configure attack surface rules and active tests, administrators and analysts require deep visibility into the underlying asset inventory and the resulting security issues. Consider adding the following permissions:

Permission	Permission Level	Reason
Asset Management	View	Required for Attack Surface Rules and Vulnerability Management to access the asset inventory where tested services and rules reside.
Cases & Issues	View or View/Edit	View: Strongly recommended for Attack Surface Rules and Vulnerability Testing to view cases/issues generated from attack surface rules and vulnerability test findings. View/Edit: Recommended for Attack Surface Rules and Vulnerability Testing if required to triage/respond to issues from attack surface rules/vulnerability test findings.
Attack Surface Rules	View	Strongly recommended for Vulnerability Testing. Provides visibility into the attack surface rules that define what is being tested. Helps users understand the context of vulnerability test results.
Vulnerability Management	View	Recommended for Vulnerability Management. Provides access to the broader vulnerability management dashboards where test findings are aggregated into vulnerability issues. Useful for understanding the full lifecycle of a finding.