Data Management permissions

Configure permissions for data management.

Controls access to dataset configuration, data transformation rules, and data lifecycle management in Cortex XDR through Settings → Configurations → Data Management.

This permission includes:

• Dataset Management: For viewing and managing datasets
• Parsing Rules: For data transformation during ingestion
• Data Model Rules: For data normalization
• Event Forwarding: For sending data to external systems

This permission only offers None or View/Edit access. While SOC Tier-2, Tier-3, and Threat Hunters may need to view data schemas for advanced investigations, granting them View/Edit access gives them full control to alter parsing rules, modify datasets, and change ingestion pipelines. Grant this permission with caution and ensure proper change management protocols are in place.

Permission	Description	Roles Example
None	Users cannot access any Data Management configuration pages.	SOC Tier-1 Analyst: Data management configuration is outside Tier-1 responsibilities.
View/Edit	Full control over creating/managing datasets, modifying parsing rules, and configuring advanced ingestion pipelines.	SOC Tier-2 and 3 Analysts: May need to understand data schemas during investigations/advanced analysis. Threat Hunter: May need to understand data schemas and transformations for hunting. Security Engineer: Primary responsibility for configuring data pipelines and transformations.

Required and recommended permissions

Consider adding the following permissions:

Permission	Permission Level	Permissions
Public APIs	View/Edit	Compute Unit Usage page access; without this, the Compute Unit Usage page is inaccessible. Required.
Forensics	View/Edit	Data Export functionality; without this, the Data Export page is inaccessible. Required.
Agent Profiles	View/Edit	Some dataset operations reference profiles; needed for full context. Strongly recommended.
Query Center	View/Edit	Running XQL queries against managed datasets. Strongly recommended.
Data Sources	View/Edit	Understanding which data sources feed into managed datasets. Recommended.