> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/application-security-permissions/application-security-generic-collector-permissions.md).

# Application Security - Generic Collector permissions

Configure permissions for Application Security generic collectors.

The Generic Collector is a data source integration type within the Application Security module that allows ingestion of code scan data from external third-party security tools into Cortex XDR. Access the **3rd party AppSec Collector** data source by going to **Settings** → **Data Sources & Integrations**

Unlike built-in VCS integrations (GitHub, GitLab, etc.) and CI/CD integrations (Jenkins, CircleCI, etc.), the Generic Collector provides a flexible API endpoint for receiving scan results in supported formats (e.g., SARIF). Each collector instance is assigned a unique API URL and API key for external tool authentication.

{% hint style="info" %}

### Notice

Scan results ingested by the collector flow into Cortex XDR require a Cloud Posture Security or Cloud Runtime Security license plus the Application Security add-on.
{% endhint %}

| Permission | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                           | Roles Example                                                                                                                                                                                                       |
| ---------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| None       | No access to the **3rd Party AppSec Collector** on the Data Sources page.                                                                                                                                                                                                                                                                                                                                                                                             | SOC Tier-1, 2, and 3 Analysts, and Threat Hunters: They do not need to create/modify collectors. None is appropriate.                                                                                               |
| View/Edit  | <p>Full access to create, configure, view, enable/disable, and delete the <strong>3rd Party AppSec Collector</strong> instances, provided users also have Data Sources View/Edit permission.</p><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>If users have View permission for Data Sources, they can view the <strong>3rd Party AppSec Collector</strong>, but cannot create or edit.</p></div> | Security Engineers: Responsible for configuring and maintaining the security tooling pipeline. They need to create new collectors, configure detection methods, manage API keys, and troubleshoot ingestion issues. |

**Required and recommended permissions**

The following permissions are needed alongside the Generic Collector permission for effective use. These apply generally regardless of role.

| Permission      | Permission Level  | Reason                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
| --------------- | ----------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Data Sources    | View or View/Edit | <ul><li>View: The <strong>Data Sources</strong> page is the only path to access collector management. Without this permission, the user cannot reach the collector management interface, even if they have Generic Collector View/Edit. Required.</li><li>View/Edit: Creating, editing, enabling/disabling, and deleting collectors requires the Data Sources action permission. Without it, the user can only view collectors in read-only mode. Required.</li></ul> |
| Asset Inventory | View or View/Edit | <ul><li>View: To view the AppSec issues generated from collector-ingested data. Without this, the user can manage collectors but cannot see the resulting security findings. Strongly recommended.</li><li>View/Edit: To manage and remediate issues that originate from collector-ingested data (e.g., change issue status, assign issues, create exclusions). Strongly recommended.</li></ul>                                                                       |
| Integrations    | View/Edit         | <ul><li>View: View integration status and health for connected tools on the <strong>Data Sources & Integrations</strong> page. Recommended.</li><li>View/Edit: The <strong>Data Sources & Integrations</strong> page is shared between data sources and integrations. Having integration permissions provides a complete view of all connected tools. Strongly recommended</li></ul>                                                                                  |
| Query Center    | View & View/Edit  | <ul><li>View: Run XQL queries on data ingested through collectors for investigation purposes. Recommended.</li><li>View/Edit: Execute advanced queries on collector-ingested scan data. Recommended.</li></ul>                                                                                                                                                                                                                                                        |
| Cases & Issues  | View/Edit         | Correlate collector-sourced AppSec issues with cases and issues. Recommended.                                                                                                                                                                                                                                                                                                                                                                                         |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/application-security-permissions/application-security-generic-collector-permissions.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.