> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/response-permissions/automation-rules.md).

# Automation Rules

Controls access to the automated response rules engine on Investigation & Response → Automation → Automation Rules page.

Automation Rules allow organizations to define condition-based rules that automatically trigger actions when specific issues match predefined criteria.

| Permission | Description                                                                                                                                                                                                                                        | Example Role                                                                                                                                                                                                                                                                                                                       |
| ---------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| None       | No access to the Automation Rules page.                                                                                                                                                                                                            |                                                                                                                                                                                                                                                                                                                                    |
| View       | Users can view all automation rules, their configurations, conditions, execution history, and settings on the Automation Rules page, but cannot make any changes.                                                                                  | <ul><li>SOC Tier 1 and 2 Analysts: May need to understand what automation rules exist and review the audit log to see which rules triggered on issues.</li><li>Threat Hunter: Need visibility into automation rules to understand what automated responses are in place and to review the audit log for hunting context.</li></ul> |
| View/Edit  | <p>Users have full access to create, modify, delete, and manage automation rules, including settings configuration.</p><p>You must also grant Cases & Issues View/Edit; otherwise, users will see the Automation Rules page in read-only mode.</p> | Security Engineer: Responsible for designing and maintaining the automation framework. They create, test, and optimize automation rules, configure action limits, and manage notification channels.                                                                                                                                |

**Required and recommended permissions**

Consider adding the following permissions:

| Permission            | Permission Level  | Reason                                                                                                                                                                                                                                                                          |
| --------------------- | ----------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Cases & Issues        | View or View/Edit | <ul><li>View: View issue data that automation rules act upon. Without it, users cannot see the issues that trigger rules or understand rule conditions in context. Strongly recommended.</li><li>View/Edit Users need View/Edit to manage Automation Rules. Required.</li></ul> |
| Action Center         | View or View/Edit | <ul><li>View: View the results of endpoint response actions (isolate, scan, etc.) triggered by automation rules. Strongly recommended.</li><li>View/Edit: Recommended if rules trigger endpoint response actions and users need to manage those actions. Recommended.</li></ul> |
| Agent Administrations | View              | View endpoint data when configuring endpoint exceptions in automation rules. Strongly recommended.                                                                                                                                                                              |
| Forensics             | View or View/Edit | <ul><li>View: Use when rules use the Forensic action type. Recommended.</li><li>View/Edit: Use when users need to take action on forensic triage results triggered by automation. Recommended.</li></ul>                                                                        |
| Scripts               | View or View/Edit | <ul><li>View: Use when rules use the Run endpoint script action type. Recommended.</li><li>View/Edit: Use when users need to manage scripts referenced by automation rules. Recommended.</li></ul>                                                                              |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-5.x/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/response-permissions/automation-rules.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.