> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/data-security-endpoint-dlp-permissions/endpoint-applications-groups.md).

# Endpoint Applications Groups

Endpoint Applications Groups allow organizing endpoint applications into logical groups for use in Data-in-motion Rules. Instead of selecting individual applications in a rule, administrators can reference an application group, making rule management more scalable. Groups can contain custom application groups (user-defined collections of applications) and catalog web application groups (predefined web application categories).

Users access Endpoint Applications by going to **Modules** → **Data Security** → **Endpoint Data-in-Motion Rules** → **Endpoint Applications Groups**.

For more information, see [Create endpoint application groups](/cortex-xdr-5.x/protect-your-endpoints/endpoint-dlp/configure-dlp-end-to-end.md#create-endpoint-application-groups).

| Permission | Description                                                                                                                                                                                                                                                                                                                 | Recommended Roles                                                                                                                                                                                                                  |
| ---------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| None       | Users cannot access the **Endpoint Applications Groups** page. These users cannot see any application groups, their members, or their usage in rules.                                                                                                                                                                       | <ul><li>SOC Tier-1 Analyst: Application group management is outside Tier-1 scope.</li><li>Application group management is outside the IT infrastructure administration scope.</li></ul>                                            |
| View       | Users can navigate to the **Endpoint Applications Groups** page and see all application groups in the grid view. They can view group names, types (Custom Application Group, Catalog Web Applications Group), member applications, and group descriptions. They cannot create groups, edit existing ones, or delete groups. | <ul><li>SOC Tier-2 and 3 Analysts: May need to review group definitions when investigating DLP issues/advanced analysis.</li><li>Threat Hunter: May need to understand application groupings for threat hunting context.</li></ul> |
| View/Edit  | Users have full control over Endpoint Applications Groups. They can create new custom application groups and catalog web application groups, edit group membership and properties, and delete groups. All context menu actions are fully accessible.                                                                        | <ul><li>Security Engineer: Responsible for organizing applications into groups for DLP rule management.</li><li>Security Admin: Full administrative access to all DLP configurations.</li></ul>                                    |

**Required and recommended permissions**

Consider adding the following permissions:

| Permission            | Permission Level | Reason                                                                                                                                                         |
| --------------------- | ---------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Endpoint Applications | View             | Strongly recommended. Applications are organized into groups; viewing groups is essential to understanding how applications are categorized and used in rules. |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/data-security-endpoint-dlp-permissions/endpoint-applications-groups.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.