Exclusion List permissions

Configure permissions for exclusion lists.

Controls access to the indicator exclusion list configuration under Settings → Configurations → Object Setup → Indicators → Exclusion List. This governs the permanent exclusion of indicators such as IP addresses, domains, URLs, file hashes, and email addresses. It is primarily used for:

• Allowing known-good or trusted infrastructure.
• Suppressing false-positive indicators identified during investigations.
• Filtering noisy vendor feeds that generate high volumes of low-value alerts.

Note

When managing Indicators (located under Threat Management → Threat Intelligence → Indicators), users who lack View/Edit permissions for the Exclusion List will find that exclusion-related features (such as the Exclusion reason field and Do not add to exclusion list checkbox) are automatically hidden by the system.

Access to the Indicators page itself requires a Threat Intelligence Management (TIM) add-on or a Cortex XDR Premium license.

Permission	Description	Roles Example
None	Users cannot view excluded indicators, add new ones, or perform imports/exports.
View	Read-only access to the full table of excluded indicators, including values, types, and comments. Users can search, filter, and export the list.	SOC Tier-1 and 2 Analysts: Should be able to see what is excluded to understand why certain indicators are not flagged, but should not modify the list without approval.
View/Edit	Full read/write access. Users can manually add or remove indicators, perform bulk CSV imports/exports, and execute bulk operations.	SOC Tier 3 Analyst: Can manage exclusions based on advanced threat analysis findings; trusted to add/remove indicators from the exclusion list. Threat Hunter: Critical for managing false positive indicators and tuning detection; threat hunters frequently need to exclude known-good indicators. Security Engineer: Manages exclusion lists as part of TI pipeline tuning and false positive reduction.

Required and recommended permissions

Consider adding the following permissions:

Permission	Permission Level	Reasons
Threat Intel	View or View/Edit	View: Required to view indicators that may need exclusion; required to see the Indicators section. View/Edit: Strongly recommended to manage indicators alongside exclusions (delete, edit indicators).
Cases & Issues	View	Understand the context of indicators being excluded (which issues they triggered). Strongly recommended.
Integrations	View	View TIM feed integrations that generate the indicators being excluded. Recommended.
Audit	View	Track who added/removed indicators from the exclusion list. Recommended.