Automation Rules

Configure permissions for automation rules.

Controls access to the automated response rules engine on Investigation & Response → Automation → Automation Rules page.

Automation Rules allow organizations to define condition-based rules that automatically trigger actions when specific issues match predefined criteria.

Permission	Description	Example Role
None	No access to the Automation Rules page.
View	Users can view all automation rules, their configurations, conditions, execution history, and settings on the Automation Rules page, but cannot make any changes.	SOC Tier 1 and 2 Analysts: May need to understand what automation rules exist and review the audit log to see which rules triggered on issues. Threat Hunter: Need visibility into automation rules to understand what automated responses are in place and to review the audit log for hunting context.
View/Edit	Users have full access to create, modify, delete, and manage automation rules, including settings configuration. You must also grant Cases & Issues View/Edit; otherwise, users will see the Automation Rules page in read-only mode.	Security Engineer: Responsible for designing and maintaining the automation framework. They create, test, and optimize automation rules, configure action limits, and manage notification channels.

Required and recommended permissions

Consider adding the following permissions:

Permission	Permission Level	Reason
Cases & Issues	View or View/Edit	View: View issue data that automation rules act upon. Without it, users cannot see the issues that trigger rules or understand rule conditions in context. Strongly recommended. View/Edit Users need View/Edit to manage Automation Rules. Required.
Action Center	View or View/Edit	View: View the results of endpoint response actions (isolate, scan, etc.) triggered by automation rules. Strongly recommended. View/Edit: Recommended if rules trigger endpoint response actions and users need to manage those actions. Recommended.
Agent Administrations	View	View endpoint data when configuring endpoint exceptions in automation rules. Strongly recommended.
Forensics	View or View/Edit	View: Use when rules use the Forensic action type. Recommended. View/Edit: Use when users need to take action on forensic triage results triggered by automation. Recommended.
Scripts	View or View/Edit	View: Use when rules use the Run endpoint script action type. Recommended. View/Edit: Use when users need to manage scripts referenced by automation rules. Recommended.