> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/attack-surface-permissions.md).
# Attack Surface permissions
Attack Surface Management (ASM) identifies exposed assets, misconfigurations, and vulnerabilities on your organization's external-facing attack surface. This permission covers the following:
* Attack Surface Rules: Detection rules that generate issues when specific external exposures are found (e.g., exposed RDP, insecure SSH).
* Vulnerability Testing: An active scanning module that performs non-intrusive and intrusive tests against discovered services to validate CVEs and exposures, generating CVSS/EPSS scores.
#### Attack Surface Rules
Attack Surface Rules permission controls access to:
* Modules → Attack Surface → Policies → Attack Surface Rules.
* Posture Management → Rules & Policies → Policies → Attack Surface Rules
For more information, see [Attack surface rules](/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/attack-surface-management/attack-surface-management-detections/attack-surface-rules.md).
| Permission | Description | Roles Example |
| ---------- | -------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| None | No access to the Attack Surface Rules page. | |
| View | Read-only access to view all attack surface rules, their status, priority, and details. | - SOC Tier 1 and 2 Analysts: Needs visibility into exposures and vulnerabilities for initial triage; should not modify rules or policies.
- Threat Hunter: Needs read access for threat research and correlation; typically does not modify rules or policies.
|
| View/Edit | Full edit access to all view permissions, including enable/disable rules, update priority, and bulk-update policies. | - SOC Tier 3 Analyst: Senior analysts who can tune attack surface rules.
- Security Engineer: Configures and tunes attack surface rules.
|
#### Required and recommended permissions
To effectively configure attack surface rules and active tests, administrators and analysts require deep visibility into the underlying asset inventory and the resulting security issues. Consider adding the following permissions:
| Permission | Permission Level | Reason |
| ------------------------ | ----------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Asset Management | View | Required for Attack Surface Rules and Vulnerability Management to access the asset inventory where tested services and rules reside. |
| Cases & Issues | View or View/Edit | - View: Strongly recommended for Attack Surface Rules and Vulnerability Testing to view cases/issues generated from attack surface rules and vulnerability test findings.
- View/Edit: Recommended for Attack Surface Rules and Vulnerability Testing if required to triage/respond to issues from attack surface rules/vulnerability test findings.
|
| Attack Surface Rules | View | Strongly recommended for Vulnerability Testing. Provides visibility into the attack surface rules that define what is being tested. Helps users understand the context of vulnerability test results. |
| Vulnerability Management | View | Recommended for Vulnerability Management. Provides access to the broader vulnerability management dashboards where test findings are aggregated into vulnerability issues. Useful for understanding the full lifecycle of a finding. |
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/attack-surface-permissions.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.