> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/configuration-permissions/data-broker-permissions.md).

# Data Broker permissions

Data Broker permissions control access to the Broker VM infrastructure.

### Broker Service

Manages Broker VMs that act as intermediaries for data collection from various sources. Brokers can host applets and other collection services. Go to **Settings** → **Configurations** → **Data Broker** → **Broker VMs**.

For more information, see [Manage Broker VM](/cortex-xdr-5.x/configure-cortex-xdr/data-management/broker-vm/manage-broker-vm.md).

{% hint style="warning" %}

### Caution

Pathfinder Applet and Pathfinder Data Collection permissions have been deprecated.

IT Admin Role: IT Admins require full View/Edit access as they are responsible for the VM infrastructure and network connectivity.
{% endhint %}

| Permission | Description                                                             | Roles Example                                                                                                                                                         |
| ---------- | ----------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| None       | Cannot view or manage Broker VMs                                        | SOC Tier 1 and 2 Analysts: Infrastructure management is not part of analyst duties.                                                                                   |
| View       | Can view Broker VMs, their status, applet configurations, and clusters. | <ul><li>SOC Tier 3 Analyst: May need visibility into data collection infrastructure.</li><li>Threat Hunter: May need to understand data collection sources,</li></ul> |
| View/Edit  | Can create, configure, and manage Broker VMs, applets, and clusters.    | Security Engineer: Responsible for data collection infrastructure and Broker management.                                                                              |

### Required and recommended permissions

Managing Broker VMs effectively requires visibility into the data sources they collect from, the agents they interact with, and the infrastructure settings that govern them. Consider adding the following permissions:

| Permission            | Permission Level | Reason                                                                                                                             |
| --------------------- | ---------------- | ---------------------------------------------------------------------------------------------------------------------------------- |
| Log Collections       | View             | Broker VMs are the primary infrastructure for log collection and need visibility into the collection status. Strongly recommended. |
| Data Sources          | View             | Understand data sources feeding through Broker VMs. Strongly recommended.                                                          |
| Agent Administrations | View             | Brokers interact with agent infrastructure; agents connect through Brokers. Strongly recommended.                                  |
| Auditing              | View             | Track changes to Broker configurations for compliance. Strongly recommended.                                                       |
| Cases & Issues        | View             | Broker issues may generate cases requiring investigation. Recommended.                                                             |
| Integrations          | View             | Brokers host integrations; need visibility into integration health. Recommended.                                                   |
| Alert Notifications   | View             | Syslog forwarding through Brokers is tied to notification configuration. Recommended.                                              |
| Live Terminal         | View             | Remote terminal access to Broker VMs for troubleshooting. Recommended.                                                             |
| General Configuration | View             | Server settings may affect Broker behavior. Recommended.                                                                           |
| Query Center          | View             | Query Broker-related data for troubleshooting collection issues. Recommended.                                                      |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/configuration-permissions/data-broker-permissions.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.