> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/automation-permissions/script-permissions.md).

# Script permissions

The Scripts permission is a foundational administrative and operational tool. In Cortex XDR, scripts (primarily Python-based) are the engine behind automated enrichment, complex data manipulation, and custom remediation actions.. For more information, see [Scripts](/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/automation/scripts.md).

{% hint style="warning" %}

### Caution

Scripts are a prerequisite for Playbooks. You cannot set Playbooks to Enabled unless Scripts is Enabled.

By enabling the Scripts component and selecting **Create scripts that will run with super user**, users gain unrestricted access to sensitive system resources. Because these scripts bypass standard security controls, this permission must be strictly limited to Security Engineers and Administrators.
{% endhint %}

Cortex XDR enforces least-privileged per-object access by allowing you to manage access for custom (user-defined) scripts. For more information, see [Manage access to objects](/cortex-xdr-5.x/onboard-cortex-xdr/post-deployment-steps/manage-user-roles-and-access-management/manage-access-to-objects.md).

| Component | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | Roles Example                                                                                                                                                                                                                                          |
| --------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Enabled   | <p>Can access the Scripts page, view script code and configurations, script execution results, and export script definitions.</p><p>Users can create, modify, and delete scripts depending on their per-object access and sub-permissions explained below. This can include the ability to import scripts from the Marketplace or upload custom Python code. This also allows a user to manually run a script from the CLI (War Room) or within a case.</p><p>When set to <strong>Enabled</strong>, you can grant the following additional permissions:</p><ul><li><strong>Create Scripts</strong>: Enables all methods for adding scripts to Cortex XDR. This includes the <strong>New Script</strong> button, as well as the ability to <strong>Attach</strong>, <strong>Duplicate</strong>, or <strong>Detach</strong> scripts. The user who performs these actions is automatically designated as the <strong>Owner</strong>.</li><li><strong>Edit Public Scripts</strong>: Allows the user to modify custom scripts set to <strong>Public</strong>, even if they are not the Owner.</li><li><strong>Create scripts that will run with super user</strong>: Create scripts that will run with super user, which enables users to create scripts with elevated privileges, and users can mark scripts as high risk. Scripts that run with superuser can access all system resources. If unchecked, users can only create standard scripts.</li></ul><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>Users can also view and edit Lists (under <strong>Settings</strong> → <strong>Configurations</strong> → <strong>Object Setup</strong> → <strong>Lists</strong>) provided they have Cases & Issues permissions.</p></div> | <ul><li>SOC Tier 1, 2, and 3 Analysts and Threat Hunters: Should not do script editing, but need visibility into automation workflows.</li><li>Security Engineer: Security Engineers need full script capabilities for advanced development.</li></ul> |
| Disabled  | <p>Cannot access the Scripts page, view any script configurations, see script execution results, or access any automation scripts in any context.</p><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p><strong>Scripts</strong> can only be <strong>Disabled</strong> after first setting <strong>Playbooks</strong> to <strong>Disabled</strong> and <strong>Playground</strong> to <strong>None</strong>.</p></div>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |                                                                                                                                                                                                                                                        |

**Required and recommended permissions**

Consider adding the following permissions:

| Permission       | Permission Level  | Reason                                                                                                                                                                                                                                           |
| ---------------- | ----------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Playbooks        | Enabled           | Strongly recommended, as scripts are almost always the building blocks inside a playbook. To build an automated workflow, you need both.                                                                                                         |
| Cases and Issues | View              | Strongly recommended, as script execution results are tied to cases.                                                                                                                                                                             |
| Action Center    | View or View/Edit | <ul><li>View: Strongly recommended to view script execution history in the Action Center.</li><li>View/Edit: Strongly recommended, as many scripts trigger response actions (like Isolate); the Action Center tracks these executions.</li></ul> |
| Playground       | View/Edit         | View/Edit: Recommended to test scripts before deploying (especially Super User scripts).                                                                                                                                                         |
| Credentials      | View              | View: Recommended for scripts that require API keys or tokens to talk to external 3rd-party integrations (e.g., VirusTotal, ServiceNow).                                                                                                         |
| Query Center     | View              | Recommended for scripts designed to pull and parse XQL data for custom reporting.                                                                                                                                                                |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/automation-permissions/script-permissions.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.