> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/inventory-agent-permissions/agent-groups.md).

# Agent Groups

Create and manage logical groups of endpoints. These groups are used to assign specific security policies and target actions to specific subsets of devices.

For more information, see [Define endpoint groups](/cortex-xdr-5.x/protect-your-endpoints/install-and-manage-endpoints/set-up-endpoint-protection/define-endpoint-groups.md).

| Permissions | Description                                                                                                                                       | Roles Example                                                                                                                                                                                                                                                                                                                                                                                                           |
| ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| None        | No access to the Groups page (**Inventory** → **Endpoints** → **Groups**.                                                                         |                                                                                                                                                                                                                                                                                                                                                                                                                         |
| View        | Read-only access to the **Endpoint Groups** page, including read-only access to agent group configurations, group details, members, and criteria. | <ul><li>SOC Tier 1 Analyst: Understanding which group an endpoint belongs to helps contextualize issues.</li><li>SOC Tier 2 Analyst: Group membership is important for understanding applied policies.</li><li>SOC Tier 3 Analyst: Full visibility helps understand policy application and identify misconfigurations.</li><li>Threat Hunter: Understanding endpoint grouping helps target hunting activities</li></ul> |
| View/Edit   | All view capabilities plus management actions, such as creating, editing, and deleting groups.                                                    | Security Engineer: Responsible for organizing endpoints into appropriate groups                                                                                                                                                                                                                                                                                                                                         |

**Required and recommended permissions**

Consider adding the following permissions:

| Permission                | Permission Level | Reason                                                                                                                                                                                   |
| ------------------------- | ---------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Agent Administrations     | View             | Required. Groups organize endpoints. Without endpoint visibility, group membership cannot be understood or validated.                                                                    |
| Agent Prevention Policies | View             | Required. Policies are assigned to groups. Understanding which policies target which groups is essential for group context.                                                              |
| Agent Profiles            | View             | Strongly recommended. Profiles are assigned to groups. Understanding profile assignments prevents configuration conflicts when reorganizing groups.                                      |
| Agent Extension Policies  | View             | Strongly recommended. Extension policies target groups. Understanding extension assignments prevents disrupting Device Control, Host Firewall, or Disk Encryption when modifying groups. |
| Agent Installations       | View             | Recommended. Installation packages may be targeted by group. Visibility helps coordinate deployment with group structure.                                                                |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/inventory-agent-permissions/agent-groups.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.