> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/inventory-agent-permissions/global-exceptions.md).

# Global Exceptions

Global Exceptions allow security teams to exclude specific items from detection, such as creating hash-based exceptions (SHA256, MD5) and defining path-based exceptions for files and folders.

{% hint style="info" %}

### Note

Global Exceptions are part of the Prevention section and apply to prevention policies/profiles.
{% endhint %}

{% hint style="warning" %}

### Caution

Global Exceptions can significantly impact security coverage. Implement approval workflows and regular exception reviews. Consider requiring dual approval for exception creation.
{% endhint %}

For more information, see [Add a global endpoint policy exception](/cortex-xdr-5.x/protect-your-endpoints/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-exception-profiles-and-rules/add-a-legacy-exception-rule-for-endpoints/add-a-global-endpoint-policy-exception.md).

| Permissions | Description                                                                                                                                                                                   | Roles Example                                                                                                                                                                                                                                                                                                                        |
| ----------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| None        | Cannot view the Global Exceptions menu (**Inventory** → **Endpoints** → **Policy Management** → **Prevention** → **Global Exceptions**, and cannot create an exception from an issue or case. |                                                                                                                                                                                                                                                                                                                                      |
| View        | Read-only access for the Global Exceptions menu, and cannot create an exception from an issue or case.                                                                                        | <ul><li>SOC Tier-1 Analyst: Understanding exceptions helps explain why certain files weren't blocked.</li><li>SOC Tier-2 Analyst: Exception visibility is critical for understanding why threats may have bypassed protection.</li><li>Threat Hunter: Exceptions represent potential blind spots. Hunters need visibility.</li></ul> |
| View/Edit   | All view permissions plus managing exceptions, adding an exception from an issue or case, setting exception expiration, and defining execution scope.                                         | <ul><li>SOC Tier 3 Analyst: May need temporary exceptions for remediation, requires approval.</li><li>Security Engineer: Responsible for exception management with proper documentation.</li></ul>                                                                                                                                   |

**Required and recommended permissions**

Consider adding the following permissions:

| Permission                | Permission Level | Reason                                                                                                                                                                                                                                            |
| ------------------------- | ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Agent Prevention Policies | View             | Required to view policies where exceptions apply.                                                                                                                                                                                                 |
| Cases & Issues            | View             | Recommended. Exceptions are often created in response to false positives from cases/issues. Case context helps understand exception justification. View/Edit is required, as the Add Exception action appears in the Case and Issue context menu. |
| Agent Administrations     | View             | Strongly recommended to view endpoints to assess the scope of exceptions. Helps determine if an exception should be global or targeted.                                                                                                           |
| Agent Groups              | View             | Required. Exceptions can be scoped to specific groups. Group visibility is needed to target exceptions appropriately.                                                                                                                             |
| Agent Profiles            | View             | Recommended. Understanding profile settings helps determine if an exception is needed or if a profile adjustment would be more appropriate.                                                                                                       |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/inventory-agent-permissions/global-exceptions.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.