Agent Administrations

Configure permissions for agent administration.

Agent Administration provides comprehensive endpoint and agent management capabilities, such as viewing all managed endpoints and their status, monitoring agent health, version, and connectivity, and performing agent operations (upgrade, uninstall, restart).

Permissions	Description	Roles Example
None	No access to the Endpoints menu (Inventory → Endpoints, including access to the All Endpoints page. Limited access to endpoint data in cases and in widgets.
View	Read-only access to the Endpoints menu, including the All Endpoints page, which enables users to view, for example, endpoint lists, details, upgrade, and uninstall.	SOC Tier-1 Analyst: Should focus on triage and escalation, not endpoint management. Accidental changes could impact protection. Threat Hunter: Focus on detection, not endpoint management. Should request actions through proper channels.
View/Edit	All view capabilities. When selecting View/Edit, you can select separate permissions, such as Agent Management, Retrieve Agent Data, and Agent Scan.	SOC Tier-2 and 3 Analysts: May need specific sub-options (like Isolate) for incident response, but full edit access is not required. Security Engineer: Responsible for agent lifecycle management, upgrades, and configuration.

Agent Administrations sub-permissions

Sub-permission	Description	Roles Example
Agent Management	High risk. Controls core agent lifecycle and the following configuration operations by right-clicking an endpoint from the All Endpoints page (Inventory → Endpoints → All Endpoints → Endpoint Control): Open in Interactive Mode Note Opens an interactive terminal session on the selected endpoint where you can run scripts in real-time. You need to add View/Edit permission for Agent Script and Scripts under Investigation and Response permissions. Perform Heartbeat Change Endpoint Alias Upgrade Agent version Set/Disable Agent Proxy Uninstall Agent Delete Endpoint Disable Capabilities Force Check-in Restart Agent Clear Agent Database Exclude/Include endpoints from auto upgrade Assign/Remove Endpoint Tags Note To access advanced endpoint actions like Force Check-in, Restart, and Clear Agent Database, users must hold Alt/Option while right-clicking the endpoint to open the advanced Endpoint Control menu.	Security Engineer: Primary responsibility for agent deployment, upgrades, and maintenance.
Retrieve Agent Data	Enables retrieval of detailed agent diagnostic information, logs, and operational data by right-clicking an endpoint and selecting Endpoint Control → Retrieve from Support File from the ALL Endpoints page. Users can also select Retrieve Support File Password from the Key icon on the All Endpoints page (top right-hand corner).	SOC 2 and 3 Analysts, and Security Engineer: Agent troubleshooting and support.
Agent Scan	Initiate on-demand malware scans on endpoints by right-clicking an endpoint,Security Operations → Initiate Malware Scan.	All roles. SOC Tier-1 Analysts may need View permission with approval workflow. Initiating scans can impact endpoint performance. Should escalate to Tier-2.
Change Managing Server	Reassign agents to different Cortex XDR management servers by right-clicking an endpoint and selecting Endpoint Control → Change managing server. Useful for disaster recovery, load balancing across management infrastructure, and migrating endpoints between environments (development/production). For more information, see Move agents between managing servers.	Security Engineer: May be needed for infrastructure changes or disaster recovery (with change management approval).
Pause Protection	High risk. Temporarily disable agent protection modules on endpoints by right-clicking an endpoint and selecting Endpoint Control → Pause Endpoint Protection. Caution Pausing protection leaves endpoints vulnerable to threats. This should only be used for troubleshooting or software installation that conflicts with protection.
Agent Token Management	High risk. Manage agent authentication tokens and credentials by right-clicking an endpoint and selecting Endpoint Control → View Token, or Set Temporary Token. Tokens can also be managed on the All Endpoints page when clicking the Key button (top right-hand side of the page). For more information, see Manage agent tokens. Caution Token regeneration will temporarily disconnect agents until they receive the new token. Token revocation will permanently disconnect agents until they are manually re-enrolled.

Required and recommended permissions

Consider adding the following permissions:

Permission	Permission Level	Reason
Cases & Issues	View or View/Edit	View: Strongly recommended. Without case access, users cannot follow endpoint-to-case investigation links. Also, Agent Scans are often triggered during case response. Case context helps correlate scan results with active investigations. View: Recommended for Retrieve Agent Data and Pause Protection. Retrieval is often triggered during case investigation. Case context helps document why data was retrieved. Pausing protection should only be done in the context of an active investigation or documented change. Case access provides the justification context.
Host Insights	View	Strongly recommended. Provides detailed endpoint security data, including vulnerability assessment and compliance status. Enhances endpoint context.
Action Center	View	Strongly recommended for response actions on endpoints. In particular: Agent Scan: Strongly recommended. Scan status and results are tracked in Action Center. Without it, users cannot monitor scan progress or view results. Retrieve Agent Data: Strongly recommended. Retrieval results appear in the Action Center. Without it, users cannot track retrieval status or download completed files. Pause Protection: Strongly recommended. Track when protection was paused and resumed. Essential for audit trail and ensuring protection is re-enabled. Recommended for the following: Agent Management: Track the status and history of agent management operations (upgrades, uninstalls). Agent Token Management: Recommended. Track token generation and usage history for audit purposes.
Agent Groups	View	Required. Endpoints are organized into groups. Without group visibility, users cannot understand policy targeting and endpoint organization. In particular: Agent Management: Agent upgrades, uninstalls, and proxy changes are often performed by group. Without group visibility, bulk operations lack context. Change Management Server: Server migration affects group membership and policy assignment. Understanding the current group structure is essential before migration.
Agent Prevention Policies	View	Strongly recommended. Before modifying endpoints, administrators need to understand what security policies are applied to avoid disrupting protection. In particular: Agent Management: Before uninstalling or downgrading agents, understanding applied policies prevents leaving endpoints unprotected. Change Management Server: Policies may differ between servers. Understanding current policy assignment prevents protection gaps after migration. Pause Protection: View (minimum). Strongly recommended. Understanding what protection modules are active helps assess the risk of pausing protection. Recommended for Agent Scan. Understanding prevention policy settings helps interpret scan results and determine if additional scanning is needed.
Agent Installations	View	Recommended when upgrading agents, visibility into available installation packages helps select the correct version. Strongly recommended for Agent Management. Agent upgrade requires knowing available versions. Installation packages determine what versions can be deployed.
Agent Profiles	View	Strongly recommended for Change Management Server. Profiles may differ between servers. Understanding the current profile assignment prevents configuration changes after migration.
Retrieve Agent Data	Checked	Strongly recommended for Agent Token Management. Both are often needed together.