Live Terminal permissions

Configure permissions for Live Terminal.

Live Terminal enables security teams to establish real-time interactive shell sessions with endpoints for investigation, forensic analysis, and remediation activities.

Permission	Description	Roles Example
None	No access to Live Terminal	SOC Tier-1 Analyst: Initial triage role - should not have direct endpoint shell access. Risk of accidental damage or evidence tampering. Requires advanced skills they may not have .
View/Edit	Full access to the Live Terminal Investigation & Response → Response → Live Terminal, and to start a Live Terminal in all menus such as Casuality View, Asset View, Case View, and Broker VM. Users can do the following: Initiate terminal sessions File Explorer (browse, upload, download, delete files) Task Manager (view, terminate processes) Command Line (CMD, PowerShell, Python) All terminal capabilities	SOC Tier 2 and 3 Analysts: Perform deeper investigation needing direct endpoint access for evidence collection, process analysis, and targeted remediation. Threat Hunter: Needs direct endpoint access to investigate suspicious activity, collect artifacts, analyze processes, and validate threat hypotheses. Core hunting tool. Security Engineer: Troubleshoots agent issues, tests endpoint configurations, validates security controls, and supports complex case response.

Required and recommended permissions

Response actions require deep integration with the core platform to locate endpoints, track containment history, and link actions back to the active case. Consider adding the following permissions:

Permission	Permission Level	Reason
Agent Management	View	Live Terminal is initiated from the Agent Management context menu. Without this, users have no way to browse and select endpoints. Required.
Live Terminal (Action Center)	View	Live Terminal actions are logged in the Action Center. Users need visibility into their session history and results. Recommended
Cases & Issues	View	Actions link directly to cases. Access is required to initiate response actions directly from the Causality View or Issue View context menus. Recommended.
Scripts	Enabled with checkboxes selected	Enabled with Scripts and Create Scripts selected. Required for the Action Center's Scripts tab to be visible, and required to execute items from the Agent Script Library.
Query Center	View	Recommended to view File Search results, investigate script executions, or add indicators to blocklists directly from XQL results.
Forensics	View	Complementary investigation tool. Forensic Timeline and Event Log Search provides context for Live Terminal activities. Recommended
Host Insights	View	Recommended to access the IOC Rules page to block indicators or evaluate hash exceptions.